Kavita/API/Controllers/ThemeController.cs
Joseph Milazzo 88b5ebeb69
Security Hotfix (#1415)
* Updated ngx-extended-pdf-viewer to 14.5.2 + misc security vuln

* Hooked up remove from want to read AND fixed a bug in the logic that was removing everything BUT what was passed.

Allow for bookmarks to have date info for better ordering.

* Implemented a quick way to set darkneses level on manga reader for when nightlight just isn't dark enough

* Added Japanese Series name support in the Parser

* Updated our security file with our Huntr.

* Fixed a security vulnerability where through the API, an unauthorized user could delete/modify reading lists that did not belong to them.

Fixed a bug where when creating a reading list with the name of another users, the API would throw an exception (but reading list would still get created)

* Ensure all reading list apis are authorized

* Ensured all APIs require authentication, except those that explicitly don't. All APIs are default requiring Authentication.

Fixed a security vulnerability which would allow a user to take over an admin account.

* Fixed a bug where cover-upload would accept filenames that were not expected.

* Explicitly check that a user has access to the pdf file before we serve it back.

* Enabled lock out when invalid user auth occurs. After 5 invalid auths, the user account will be locked out for 10 mins.
2022-08-08 13:47:37 -07:00

67 lines
1.7 KiB
C#

using System.Collections.Generic;
using System.Threading.Tasks;
using API.Data;
using API.DTOs.Theme;
using API.Extensions;
using API.Services;
using API.Services.Tasks;
using Kavita.Common;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
namespace API.Controllers;
public class ThemeController : BaseApiController
{
private readonly IUnitOfWork _unitOfWork;
private readonly IThemeService _themeService;
private readonly ITaskScheduler _taskScheduler;
public ThemeController(IUnitOfWork unitOfWork, IThemeService themeService, ITaskScheduler taskScheduler)
{
_unitOfWork = unitOfWork;
_themeService = themeService;
_taskScheduler = taskScheduler;
}
[AllowAnonymous]
[HttpGet]
public async Task<ActionResult<IEnumerable<SiteThemeDto>>> GetThemes()
{
return Ok(await _unitOfWork.SiteThemeRepository.GetThemeDtos());
}
[Authorize("RequireAdminRole")]
[HttpPost("scan")]
public ActionResult Scan()
{
_taskScheduler.ScanSiteThemes();
return Ok();
}
[Authorize("RequireAdminRole")]
[HttpPost("update-default")]
public async Task<ActionResult> UpdateDefault(UpdateDefaultThemeDto dto)
{
await _themeService.UpdateDefault(dto.ThemeId);
return Ok();
}
/// <summary>
/// Returns css content to the UI. UI is expected to escape the content
/// </summary>
/// <returns></returns>
[HttpGet("download-content")]
public async Task<ActionResult<string>> GetThemeContent(int themeId)
{
try
{
return Ok(await _themeService.GetContent(themeId));
}
catch (KavitaException ex)
{
return BadRequest(ex.Message);
}
}
}