Ideas

Let `POST /api/Lava/RenderTemplate` use its own Enabled Lava Commands instead of the global default

Note You are not authorized to edit this feature.

0

Login To Vote

Let `POST /api/Lava/RenderTemplate` use its own Enabled Lava Commands instead of the global default

Security

Today if you want to use the /api/Lava/RenderTemplate to test Lava with specific commands, entity, sql, workflowactivate or other entity command you have to enable those commands in the global allowed commands list. I propose that this endpoint should have it's own settings for what is enabled on it. It is already a secured API endpoint so having it's own configuration without having to allow commands globally would greatly benefit dev's without compromising the entire sites security.


A separate setting for the endpoint, for example a Global Attribute or System Setting such as "Lava Render API Enabled Commands," used by `RenderTemplate` instead of `DefaultEnabledLavaCommands`. The endpoint's existing REST security still decides who can call it.


Additional context

Code: `Rock.Rest/Controllers/LavaController.cs` (`RenderTemplate`) and `Rock/Utility/ExtensionMethods/LavaExtensions.cs` (`ResolveMergeFields( this string content, IDictionary<string, object> mergeObjects, Person currentPersonOverride )` reads `DefaultEnabledLavaCommands`). Same in 19.6 and develop.

Photo of Jonathan AndersonSubmitted by Jonathan Anderson, The Ark Church  ·   ·  Security
Remove Votes
Login to add a comment...

Submission Success Tips

Cultivate your ideas for maximum impact with these helpful submission tips that will increase the chances of your brilliant concepts becoming reality.

  • Clear Title: Craft a straightforward and descriptive title that instantly conveys the essence of your idea.
  • Concise Description: Provide an idea description that is succinct, ensuring it effectively communicates the concept without unnecessary verbosity.
  • Provide Additional Details: With a concise description complete, now provide any other details that are needed to better understand the requirements.
  • Thorough Ministry Need Review: Provide a comprehensive overview of the ministry need your idea addresses, emphasizing its significance.
  • Cover the WHY: Clearly articulate the rationale behind your idea, explaining why it's essential and how it aligns with the organization's goals and mission. Oftentimes a clear "why" sheds light into other possible options.