fix: 修复触发器规则未鉴权问题 --story=119850966

TencentBlueKing · Oct 8, 2024 · b53bd29 · b53bd29
1 parent d9ad392
commit b53bd29
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 2 deletions.
diff --git a/itsm/trigger/permissions.py b/itsm/trigger/permissions.py
@@ -86,7 +86,7 @@ def has_object_permission(self, request, view, obj, **kwargs):
             # 通过流程配置需要有对应服务的管理权限
             is_workflow = False
             workflow_id = None
-            if request.data.get("source_type") == SOURCE_WORKFLOW:
+            if obj.source_type == SOURCE_WORKFLOW:
                 is_workflow = True
                 workflow_id = request.data.get("source_id")
             elif obj.source_type == SOURCE_WORKFLOW:

diff --git a/itsm/trigger/views.py b/itsm/trigger/views.py
@@ -51,6 +51,7 @@
 from .api import import_trigger
 from .validators import BulkTriggerRuleValidator
 from .permissions import WorkflowTriggerPermit
+from ..component.drf.exception import ValidationError
 
 
 class ComponentApiViewSet(component_viewsets.APIView):
@@ -90,7 +91,7 @@ class TriggerViewSet(component_viewsets.ModelViewSet):
     }
 
     permission_classes = (WorkflowTriggerPermit,)
-    permission_free_actions = ["list", "create_or_update_rules"]
+    permission_free_actions = ["list"]
 
     def get_queryset(self):
 
@@ -191,6 +192,8 @@ def _single_update(action_data, instance):
                 _data.update({"trigger_id": instance.id})
                 try:
                     rule_instance = TriggerRule.objects.get(id=_data.get("id", 0))
+                    if rule_instance.trigger_id != instance.id:
+                        raise ValidationError(_("触发器规则 ID 匹配异常"))
                     rule = _single_update(_data, rule_instance)
                 except TriggerRule.DoesNotExist:
                     rule = _single_create(_data)