Mirrors/mealie
1
0
Fork 0
mirror of https://github.com/mealie-recipes/mealie.git synced 2026-07-20 14:40:14 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix: restrict user ratings and favorites reads to the requesting user (#7903)

Browse Source
This commit is contained in:
Hayden
2026-07-18 12:33:56 -05:00
committed by GitHub
parent 8892ae1561
commit 6889101a76
2 changed files with 32 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
mealie/routes/users/ratings.py
View File

@@ -44,11 +44,13 @@ class UserRatingsController(BaseUserController):
@router.get("/{id}/ratings", response_model=UserRatings[UserRatingOut])
async def get_ratings(self, id: UUID4):
"""Get user's rated recipes"""
assert_user_change_allowed(id, self.user, self.user)
return UserRatings(ratings=self.repos.user_ratings.get_by_user(id))
@router.get("/{id}/favorites", response_model=UserRatings[UserRatingOut])
async def get_favorites(self, id: UUID4):
"""Get user's favorited recipes"""
assert_user_change_allowed(id, self.user, self.user)
return UserRatings(ratings=self.repos.user_ratings.get_by_user(id, favorites_only=True))
@router.post("/{id}/ratings/{slug}")

30
tests/integration_tests/user_recipe_tests/test_recipe_ratings.py
View File

@@ -412,3 +412,33 @@ def test_average_recipe_rating_includes_all_households(
assert response.status_code == 200
data = response.json()
assert data["rating"] == 3.5
def test_cannot_read_other_users_ratings_or_favorites_cross_group(
api_client: TestClient, unique_user: TestUser, g2_user: TestUser
):
# g2_user is in a different group entirely
response = api_client.get(api_routes.users_id_ratings(unique_user.user_id), headers=g2_user.token)
assert response.status_code == 403
response = api_client.get(api_routes.users_id_favorites(unique_user.user_id), headers=g2_user.token)
assert response.status_code == 403
def test_cannot_read_other_users_ratings_or_favorites_same_group(
api_client: TestClient, unique_user: TestUser, h2_user: TestUser
):
# h2_user is in the same group but a different household
response = api_client.get(api_routes.users_id_ratings(unique_user.user_id), headers=h2_user.token)
assert response.status_code == 403
response = api_client.get(api_routes.users_id_favorites(unique_user.user_id), headers=h2_user.token)
assert response.status_code == 403
def test_can_read_own_ratings_and_favorites_via_id_route(api_client: TestClient, unique_user: TestUser):
response = api_client.get(api_routes.users_id_ratings(unique_user.user_id), headers=unique_user.token)
assert response.status_code == 200
response = api_client.get(api_routes.users_id_favorites(unique_user.user_id), headers=unique_user.token)
assert response.status_code == 200