From d19fcf97028d1453448bc8b867657301000910f6 Mon Sep 17 00:00:00 2001 From: svader0 Date: Mon, 24 Aug 2026 12:04:16 -0500 Subject: [PATCH] Apply the global template gate to the add-from-template listing The listing renders finding-template content, which is a shared cross-product store, but its only authorization was view access to the object named in the URL. The sibling routes that read the same store already require the global permission. The check goes in the view body rather than the route permission map so it applies the same way on every edition. --- dojo/test/ui/views.py | 2 ++ unittests/test_apply_finding_template.py | 15 +++++++++++++++ 2 files changed, 17 insertions(+) diff --git a/dojo/test/ui/views.py b/dojo/test/ui/views.py index 73da2caf70..4fa00848a6 100644 --- a/dojo/test/ui/views.py +++ b/dojo/test/ui/views.py @@ -803,6 +803,8 @@ def add_finding_from_template(request, tid, fid): def search(request, tid): test = get_object_or_404(Test, id=tid) + # This listing returns template content, a shared cross-product store + user_has_global_permission_or_403(request.user, "edit") templates = Finding_Template.objects.all() templates = TemplateFindingFilter(request.GET, queryset=templates) paged_templates = get_page_items(request, templates.qs, 25) diff --git a/unittests/test_apply_finding_template.py b/unittests/test_apply_finding_template.py index 04b2b2f0cd..0189d0d049 100644 --- a/unittests/test_apply_finding_template.py +++ b/unittests/test_apply_finding_template.py @@ -690,3 +690,18 @@ def test_staff_with_global_edit_still_reads_template(self): with impersonate(staff): result = views.choose_finding_template_options(request, tid=self.template.id, fid=self.own_finding.id) self.assertEqual(200, result.status_code) + + def test_search_listing_denied(self): + request = FindingTemplateTestUtil.create_get_request( + self.attacker, f"/test/{self.test_a.id}/search") + with impersonate(self.attacker), self.assertRaises(PermissionDenied): + test_views.search(request, tid=self.test_a.id) + + def test_search_listing_allows_global_edit(self): + staff = FindingTemplateTestUtil.create_user(is_staff=True) + request = FindingTemplateTestUtil.create_get_request( + staff, f"/test/{self.test_a.id}/search") + with impersonate(staff): + result = test_views.search(request, tid=self.test_a.id) + self.assertEqual(200, result.status_code) + self.assertIn(self.SECRET, result.content.decode())