commit 8251ffee18bc18b7cdda281b3ec137023aa79303
author Ed Tanous <ed.tanous@intel.com> Thu Oct 10 14:33:54 2019 -0700
committer Ed Tanous <ed.tanous@intel.com> Mon Oct 21 20:25:08 2019 +0000
tree 13e8e75db89cb31bb595723f758fe4cc319fb954
parent 1f56a3a6031ba5992d52532cf2d32c76253c9167

Add "requires" handlers to all non-trivial routes

This commit is the result of an audit to add user levels to the various
components that need them.  As written:

KVM requires admin privilege
Virtual media requires admin privilege
image upload requires admin privilege
/subscribe API requies Login privilege

Signed-off-by: Ed Tanous <ed.tanous@intel.com>
Change-Id: I6384f23769a5ac23f653519656721da7373f088f

include/image_upload.hpp

diff --git a/include/image_upload.hpp b/include/image_upload.hpp
index ba9c403..69e5637 100644
--- a/include/image_upload.hpp
+++ b/include/image_upload.hpp
@@ -111,6 +111,7 @@
 template <typename... Middlewares> void requestRoutes(Crow<Middlewares...>& app)
 {
     BMCWEB_ROUTE(app, "/upload/image/<str>")
+        .requires({"ConfigureComponents", "ConfigureManager"})
         .methods("POST"_method,
                  "PUT"_method)([](const crow::Request& req, crow::Response& res,
                                   const std::string& filename) {
@@ -118,6 +119,7 @@
         });
 
     BMCWEB_ROUTE(app, "/upload/image")
+        .requires({"ConfigureComponents", "ConfigureManager"})
         .methods("POST"_method, "PUT"_method)(
             [](const crow::Request& req, crow::Response& res) {
                 uploadImageHandler(req, res, "");