Fix: Restrict non-owner from attaching pam scripts

keepercommander/attachment.py

@@ -129,6 +129,7 @@ def __init__(self):
         self.name = ''
         self.title = ''
         self.thumbnail = None   # type: Optional[bytes]
+        self.is_script = False
 
     def prepare(self):
         pass
@@ -150,10 +151,11 @@ def open(self):
 
 
 class FileUploadTask(UploadTask):
-    def __init__(self, file_path):
+    def __init__(self, file_path, is_script=False):
         super().__init__()
         self.file_path = file_path
         self.name = os.path.basename(self.file_path)
+        self.is_script = is_script
 
     def prepare(self):
         self.file_path = os.path.expanduser(self.file_path)
@@ -247,6 +249,7 @@ def upload_attachments(params, record, attachments):
             file.record_uid = file_uid
             file.record_key = crypto.encrypt_aes_v2(file_key, params.data_key)
             file.fileSize = task.size + 100
+            file.is_script = task.is_script
             file_data = {
                 'title': task.title or task.name,
                 'name': task.name or '',
@@ -267,6 +270,9 @@ def upload_attachments(params, record, attachments):
             file_uid = uo.record_uid
             task = file_tasks[file_uid]
             if uo.status != record_pb2.FA_SUCCESS:
+                if task.is_script:
+                    raise Exception(
+                        f'Uploading rotation script {task.name}: only the record owner can attach post-rotation scripts.')
                 raise Exception(f'Uploading file {task.name}: Get upload URL error.')
 
             file_key = file_keys[file_uid]

keepercommander/commands/discoveryrotation.py

@@ -3050,7 +3050,7 @@ def execute(self, params, **kwargs):
         facade = record_facades.FileRefRecordFacade()
         facade.record = record
         pre = set(facade.file_ref)
-        upload_task = attachment.FileUploadTask(full_name)
+        upload_task = attachment.FileUploadTask(full_name, is_script=True)
         attachment.upload_attachments(params, record, [upload_task])
         post = set(facade.file_ref)
         df = post.difference(pre)

keepercommander/commands/discoveryrotation_v1.py

@@ -1355,7 +1355,7 @@ def execute(self, params, **kwargs):
         facade = record_facades.FileRefRecordFacade()
         facade.record = record
         pre = set(facade.file_ref)
-        upload_task = attachment.FileUploadTask(full_name)
+        upload_task = attachment.FileUploadTask(full_name, is_script=True)
         attachment.upload_attachments(params, record, [upload_task])
         post = set(facade.file_ref)
         df = post.difference(pre)

keepercommander/commands/pam_import/base.py

@@ -3695,7 +3695,7 @@ def add_pam_scripts(params, record, scripts):
             facade = record_facades.FileRefRecordFacade()
             facade.record = rec
             pre = set(facade.file_ref)
-            upload_task = attachment.FileUploadTask(full_name)
+            upload_task = attachment.FileUploadTask(full_name, is_script=True)
             attachment.upload_attachments(params, rec, [upload_task])
             post = set(facade.file_ref)
             df = post.difference(pre)