Improve GraphQL content item authorization handling#19098
Conversation
Refactored ContentItemQuery to remove IHttpContextAccessor and use context.RequestServices for service resolution. Added user authorization checks before returning content items in GraphQL queries, ensuring only authorized users can access content. Passed context.User into GraphQL execution options for resolver access. Cleaned up constructor and removed unnecessary usings. Enhances security and modernizes dependency injection usage.
Enforce ExecuteGraphQL permission on the contentItem GraphQL field and ensure null is returned if the content item does not exist. Add tests to verify access control for users with and without ViewContent permission.
|
This contains the same fix as #19102, but for v3 I slightly changed the implementation. There is no need to use the This PR also sets the |
|
@MikeAlhayek please merge if OK. |
|
Let's merge it once 2.2 is merged back to main |
|
This pull request has merge conflicts. Please resolve those before requesting a review. |
|
@copilot resolve the merge conflicts in this pull request |
…uthorization # Conflicts: # src/OrchardCore/OrchardCore.ContentManagement.GraphQL/Queries/ContentItemQuery.cs # test/OrchardCore.Tests/Apis/GraphQL/ContentManagement/ContentItemQueryTests.cs Co-authored-by: gvkries <7062785+gvkries@users.noreply.github.com>
Resolved the merge conflicts in commit The two conflicts were:
|
|
@copilot Please fix the build error: Error: /home/runner/work/OrchardCore/OrchardCore/test/OrchardCore.Tests/Apis/GraphQL/ContentManagement/ContentItemQueryTests.cs(71,68): error CS0104: 'ISession' is an ambiguous reference between 'Microsoft.AspNetCore.Http.ISession' and 'YesSql.ISession' [/home/runner/work/OrchardCore/OrchardCore/test/OrchardCore.Tests/OrchardCore.Tests.csproj::TargetFramework=net10.0] |
Agent-Logs-Url: https://github.com/OrchardCMS/OrchardCore/sessions/b57c85f7-d211-44c9-97a2-efa977a88e67 Co-authored-by: gvkries <7062785+gvkries@users.noreply.github.com>
Fixed in commit |
Refactored ContentItemQuery to remove IHttpContextAccessor and use context.RequestServices for service resolution. Added user authorization checks before returning content items in GraphQL queries, ensuring only authorized users can access content. Passed context.User into GraphQL execution options for resolver access. Cleaned up constructor and removed unnecessary usings. Enhances security and modernizes dependency injection usage.
/cc @MikeAlhayek @Piedone