Skip to content

Commit 22bb1c5

Browse files
committed
Return 403 for Nested Topics
Nested Topics are not (currently) intended to be accessed directly. If a request is made directly to a nested topic, it should be rejected. This accomplishes this by returning a 403 on requests to a nested topic or its container (based on the `ContentType` being set to `List`).
1 parent 35f27d2 commit 22bb1c5

1 file changed

Lines changed: 13 additions & 1 deletion

File tree

Ignia.Topics.Web.Mvc/Controllers/TopicController.cs

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
using System;
77
using System.Diagnostics.Contracts;
88
using System.Linq;
9+
using System.Net;
910
using System.Threading.Tasks;
1011
using System.Web.Mvc;
1112
using Ignia.Topics.Mapping;
@@ -151,7 +152,18 @@ protected override void OnActionExecuting(ActionExecutingContext filterContext)
151152
}
152153

153154
/*------------------------------------------------------------------------------------------------------------------------
154-
| Handle page group
155+
| Handle nested topics
156+
>-----------------------------------------------------------------------------------------------------------------------—-
157+
| Nested topics are not expected to be viewed directly; if a user requests a nested topic, return a 403 to indicate that
158+
| the request is valid, but forbidden.
159+
\-----------------------------------------------------------------------------------------------------------------------*/
160+
if (CurrentTopic.ContentType.Equals("List") || CurrentTopic.Parent.ContentType.Equals("List")) {
161+
filterContext.Result = new HttpStatusCodeResult(HttpStatusCode.Forbidden);
162+
return;
163+
}
164+
165+
/*------------------------------------------------------------------------------------------------------------------------
166+
| Handle page groups
155167
>-----------------------------------------------------------------------------------------------------------------------—-
156168
| PageGroups are a special content type for packaging multiple pages together. When a PageGroup is identified, the user is
157169
| redirected to the first (non-hidden, non-disabled) page in the page group.

0 commit comments

Comments
 (0)