Add permission checks for various API views to enhance security

yogeshojha · yogeshojha · commit fb2b59d5d3a9 · 2025-02-04T10:15:22.000+05:30
diff --git a/web/api/views.py b/web/api/views.py
@@ -333,6 +333,9 @@ def clear_all(self, request):
 
 
 class OllamaManager(APIView):
+	permission_classes = [HasPermission]
+	permission_required = PERM_MODIFY_SYSTEM_CONFIGURATIONS
+
 	def get(self, request):
 		"""
 		API to download Ollama Models
@@ -918,6 +921,9 @@ def post(self, request):
 
 
 class AddTarget(APIView):
+	permission_classes = [HasPermission]
+	permission_required = PERM_MODIFY_TARGETS
+
 	def post(self, request):
 		req = self.request
 		data = req.data
@@ -1053,6 +1059,9 @@ def post(self, request):
 
 
 class DeleteMultipleRows(APIView):
+	permission_classes = [HasPermission]
+	permission_required = PERM_MODIFY_TARGETS
+
 	def post(self, request):
 		req = self.request
 		data = req.data
@@ -1072,6 +1081,9 @@ def post(self, request):
 
 
 class StopScan(APIView):
+	permission_classes = [HasPermission]
+	permission_required = PERM_INITATE_SCANS_SUBSCANS
+
 	def post(self, request):
 		req = self.request
 		data = req.data
@@ -1169,6 +1181,9 @@ def abort_subscan(subscan):
 
 
 class InitiateSubTask(APIView):
+	permission_classes = [HasPermission]
+	permission_required = PERM_INITATE_SCANS_SUBSCANS
+
 	def post(self, request):
 		req = self.request
 		data = req.data
@@ -1188,6 +1203,9 @@ def post(self, request):
 
 
 class DeleteSubdomain(APIView):
+	permission_classes = [HasPermission]
+	permission_required = PERM_MODIFY_SCAN_RESULTS
+
 	def post(self, request):
 		req = self.request
 		for id in req.data['subdomain_ids']:
@@ -1196,6 +1214,9 @@ def post(self, request):
 
 
 class DeleteVulnerability(APIView):
+	permission_classes = [HasPermission]
+	permission_required = PERM_MODIFY_SCAN_RESULTS
+
 	def post(self, request):
 		req = self.request
 		for id in req.data['vulnerability_ids']:
@@ -1265,6 +1286,9 @@ def get(self, request):
 
 
 class UninstallTool(APIView):
+	permission_classes = [HasPermission]
+	permission_required = PERM_MODIFY_SYSTEM_CONFIGURATIONS
+
 	def get(self, request):
 		req = self.request
 		tool_id = req.query_params.get('tool_id')
@@ -1303,6 +1327,9 @@ def get(self, request):
 
 
 class UpdateTool(APIView):
+	permission_classes = [HasPermission]
+	permission_required = PERM_MODIFY_SYSTEM_CONFIGURATIONS
+
 	def get(self, request):
 		req = self.request
 		tool_id = req.query_params.get('tool_id')
@@ -1335,6 +1362,9 @@ def get(self, request):
 			return Response({'status': False, 'message': str(e)})
 
 class GetExternalToolCurrentVersion(APIView):
+	permission_classes = [HasPermission]
+	permission_required = PERM_MODIFY_SYSTEM_CONFIGURATIONS
+
 	def get(self, request):
 		req = self.request
 		# toolname is also the command
@@ -1371,6 +1401,9 @@ def get(self, request):
 
 
 class GithubToolCheckGetLatestRelease(APIView):
+	permission_classes = [HasPermission]
+	permission_required = PERM_MODIFY_SYSTEM_CONFIGURATIONS
+	
 	def get(self, request):
 		req = self.request
 
