dao_get_template_email_file_by_id: look up the file by service ID too - #4948
Draft
joybytes wants to merge 1 commit into
Draft
dao_get_template_email_file_by_id: look up the file by service ID too#4948joybytes wants to merge 1 commit into
joybytes wants to merge 1 commit into
Conversation
The internal API trusted the file ID on its own, so a mismatched service or template in the URL still returned the file. The admin app blocks this, so it was not exploitable, but the DAO should enforce it as well. Service ID is now required and the caller can also pass the template ID, which matters where a user can see one template in a service but not another because of restricted folders. A file that does not match the route now raises NoResultFound, which the API turns into a 404.
joybytes
commented
Aug 28, 2026
| @autocommit | ||
| def dao_get_template_email_file_by_id(template_email_file_id): | ||
| return TemplateEmailFile.query.filter(TemplateEmailFile.id == template_email_file_id).one() | ||
| def dao_get_template_email_file_by_id(service_id, template_email_file_id, template_id=None): |
Contributor
Author
There was a problem hiding this comment.
check if this function should be through replica
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Make
dao_get_template_email_file_by_idtake the service ID, and pass the service and template IDs from theget_template_email_file_by_idendpoint. The DAO joins on templates to check the file belongs to that service, and optionally checks it belongs to that template.This came from the scan report which said: The endpoint looked files up by file ID alone, so the service and template in the URL were ignored. The admin app already does the authorisation checks, so this is not exploitable and was triaged as low, but we want the DAO to filter by service ID like it does elsewhere.
Checking the template ID as well is worth having because of restricted template folders: within one service a user can be allowed to see one template but not another, so the file should have to belong to the template in the URL, not just the service.