Conversation
lovasoa
left a comment
lovasoa
left a comment
There was a problem hiding this comment.
Thank you for opening a PR !
However, it looks like the new implementation does not actually prevent the user from sending write commands to the socket.io handler. Users can actually write to the board even with a simple viewer token, the menu is just hidden in the ui
index.py
Outdated
| # encode.py | ||
| import datetime | ||
| import jwt # import jwt library | ||
| SECRET_KEY = "test123" | ||
| # json data to encode | ||
| json_data = { | ||
| "roles": ["moderator:firstboard","viewer:hboard"] | ||
| } | ||
| encode_data = jwt.encode(payload=json_data, \ | ||
| key=SECRET_KEY, algorithm="HS256") | ||
| print(encode_data) No newline at end of file |
There was a problem hiding this comment.
| # encode.py | |
| import datetime | |
| import jwt # import jwt library | |
| SECRET_KEY = "test123" | |
| # json data to encode | |
| json_data = { | |
| "roles": ["moderator:firstboard","viewer:hboard"] | |
| } | |
| encode_data = jwt.encode(payload=json_data, \ | |
| key=SECRET_KEY, algorithm="HS256") | |
| print(encode_data) |
We probably don't want to create a python script here
package.json
Outdated
| "polyfill-library": "^3.107.1", | ||
| "serve-static": "^1.14.1", | ||
| "socket.io": "^4", | ||
| "socket.io": "^4.6.1", |
There was a problem hiding this comment.
This does not seem to be linked to the current PR. You can open a distinct pr to update dependencies
| parameters(parsedUrl, request, isModerator) { | ||
| const params = super.parameters(parsedUrl, request, isModerator); | ||
| const parts = parsedUrl.pathname.split("boards/", 2); | ||
| console.log(parts[1]); |
There was a problem hiding this comment.
| console.log(parts[1]); |
| if (userRole === "viewer") { | ||
| params["hideMenu"] = true; | ||
| } else { | ||
| params["hideMenu"] = false; |
There was a problem hiding this comment.
| params["hideMenu"] = false; | |
| params["hideMenu"] = false; |
you don't want to override that. keep the value from the query
|
I've converted the PR to a draft, feel free to pass it back to "ready for review" when you want me to look at it again |
2 participants
I've made an update to our whiteboard application that adds a new "viewer" permission to the JWT payload. This update will allow us to restrict users to only viewing the whiteboard, without giving them editing capabilities.