mirror of
https://github.com/bookorbit/bookorbit.git
synced 2026-11-03 00:11:37 -06:00
neon
26b7c602f8
Require manage_book_dock for the settings UI and the scoped API so regular Book Dock users cannot view or modify administrative configuration. Reject every Book Dock key on the generic PATCH /app-settings/:key route as well, including book_dock_paused. That route accepted the same keys with any string value, so an operator with manage_app_settings could store an out-of-range threshold or an unknown metadata mode and bypass the validation the scoped endpoints apply. Closes #1003
44 lines
1.1 KiB
JSON
44 lines
1.1 KiB
JSON
{
|
|
"totalRoutes": 374,
|
|
"byPermission": {
|
|
"(none)": 166,
|
|
"Permission.ManageMetadataConfig": 32,
|
|
"Permission.EmailSend": 30,
|
|
"Permission.LibraryEditMetadata": 33,
|
|
"Permission.BookDockAccess": 16,
|
|
"Permission.ManageAppSettings": 22,
|
|
"Permission.ManageLibraries": 14,
|
|
"Permission.ManageUsers": 11,
|
|
"Permission.ManageEmail": 8,
|
|
"Permission.KoboSync": 7,
|
|
"Permission.NotificationAccess": 6,
|
|
"Permission.DemoRestricted": 6,
|
|
"Permission.KoreaderSync": 8,
|
|
"Permission.OpdsAccess": 4,
|
|
"Permission.ViewAuditLog": 1,
|
|
"Permission.ViewUserActivity": 6,
|
|
"Permission.LibraryDeleteBooks": 1,
|
|
"Permission.LibraryDownload": 1,
|
|
"Permission.LibraryUpload": 2,
|
|
"Permission.ManageBookDock": 3,
|
|
"Permission.ManageIcons": 1,
|
|
"Permission.HardcoverSync": 1,
|
|
"Permission.ReadwiseSync": 1,
|
|
"Permission.StorygraphSync": 1
|
|
},
|
|
"byLibraryAccess": {
|
|
"'viewer'": 3,
|
|
"'editor'": 1
|
|
},
|
|
"routeChunks": [
|
|
"routes-01.json",
|
|
"routes-02.json",
|
|
"routes-03.json",
|
|
"routes-04.json",
|
|
"routes-05.json",
|
|
"routes-06.json",
|
|
"routes-07.json",
|
|
"routes-08.json"
|
|
]
|
|
}
|