From e4b398e7f74fae21d0cabc6fe9561ab4d1036a65 Mon Sep 17 00:00:00 2001 From: anupamme Date: Wed, 5 Aug 2026 11:33:55 +0000 Subject: [PATCH] fix: V-002 security vulnerability Automated security fix generated by OrbisAI Security --- api/helpers.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/api/helpers.py b/api/helpers.py index 963fb33..dd419cf 100644 --- a/api/helpers.py +++ b/api/helpers.py @@ -295,19 +295,20 @@ def check_viewport_owner(request, viewport_name): """Check if the current user is admin or owner of the viewport. Returns (True, None) if authorized, (False, JsonResponse 403) if not. - Viewports without _config.json (legacy) are allowed for anyone. + Viewports without _config.json (legacy) are denied for non-superusers + since ownership cannot be verified. """ if request.user.is_superuser: return True, None current_user = request.user.username if request.user.is_authenticated else None config_file = VIEWPORTS_DIR / f'{viewport_name}_config.json' if not config_file.exists(): - return True, None + return False, JsonResponse({'success': False, 'error': 'Permission denied'}, status=403) try: with open(config_file) as f: cfg = json.load(f) except Exception: - return True, None + return False, JsonResponse({'success': False, 'error': 'Permission denied'}, status=403) owner = cfg.get('created_by') if not owner or owner == current_user: return True, None