From 078bedd8e86caf2c09926e19027932ca063d5996 Mon Sep 17 00:00:00 2001 From: Umputun Date: Sun, 7 Apr 2019 18:34:20 -0500 Subject: [PATCH] separate caching key URLKeyWithUser for find only --- backend/app/rest/api/rest.go | 11 +++++++++++ backend/app/rest/api/rest_public.go | 2 +- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/backend/app/rest/api/rest.go b/backend/app/rest/api/rest.go index bcc85bdd..1a3e66d3 100644 --- a/backend/app/rest/api/rest.go +++ b/backend/app/rest/api/rest.go @@ -398,6 +398,17 @@ func filterComments(comments []store.Comment, fn func(c store.Comment) bool) []s // URLKey gets url from request to use it as cache key // admins will have different keys in order to prevent leak of admin-only data to regular users func URLKey(r *http.Request) string { + adminPrefix := "admin!!" + key := strings.TrimPrefix(r.URL.String(), adminPrefix) // prevents attach with fake url to get admin view + if user, err := rest.GetUserInfo(r); err == nil && user.Admin { + key = adminPrefix + key // make separate cache key for admins + } + return key +} + +// URLKeyWithUser gets url from request to use it as cache key and attaching user ID +// admins will have different keys in order to prevent leak of admin-only data to regular users +func URLKeyWithUser(r *http.Request) string { adminPrefix := "admin!!" key := strings.TrimPrefix(r.URL.String(), adminPrefix) // prevents attach with fake url to get admin view if user, err := rest.GetUserInfo(r); err == nil { diff --git a/backend/app/rest/api/rest_public.go b/backend/app/rest/api/rest_public.go index 1b0c0338..815c400c 100644 --- a/backend/app/rest/api/rest_public.go +++ b/backend/app/rest/api/rest_public.go @@ -28,7 +28,7 @@ func (s *Rest) findCommentsCtrl(w http.ResponseWriter, r *http.Request) { } log.Printf("[DEBUG] get comments for %+v, sort %s, format %s", locator, sort, r.URL.Query().Get("format")) - key := cache.NewKey(locator.SiteID).ID(URLKey(r)).Scopes(locator.SiteID, locator.URL) + key := cache.NewKey(locator.SiteID).ID(URLKeyWithUser(r)).Scopes(locator.SiteID, locator.URL) data, err := s.Cache.Get(key, func() ([]byte, error) { comments, e := s.DataService.Find(locator, sort) if e != nil {