Skip to content

Commit fa4f0e5

Browse files
JohnDupreyJohnDuprey
authored
Merge pull request #1477 from KelvinTegelaar/dev
Dev to hotfix
2 parents b8ffaad + 051c3ba commit fa4f0e5

15 files changed

+446
-46
lines changed

‎Modules/CIPPCore/Public/Add-CIPPDelegatedPermission.ps1

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,10 @@ function Add-CIPPDelegatedPermission {
114114
$OldScope = ($CurrentDelegatedScopes | Where-Object -Property Resourceid -EQ $svcPrincipalId.id)
115115

116116
if (!$OldScope) {
117+
if ([string]::IsNullOrEmpty($NewScope) -or $NewScope -eq ' ') {
118+
$Results.add("No delegated permissions to add for $($svcPrincipalId.displayName)")
119+
continue
120+
}
117121
try {
118122
$Createbody = @{
119123
clientId = $ourSVCPrincipal.id
@@ -147,6 +151,13 @@ function Add-CIPPDelegatedPermission {
147151
$Results.add("All delegated permissions exist for $($svcPrincipalId.displayName)")
148152
continue
149153
}
154+
155+
if ([string]::IsNullOrEmpty($NewScope) -or $NewScope -eq ' ') {
156+
# No permissions to update
157+
$Results.add("No delegated permissions to update for $($svcPrincipalId.displayName)")
158+
continue
159+
}
160+
150161
$Patchbody = @{
151162
scope = "$NewScope"
152163
} | ConvertTo-Json -Compress

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecModifyCalPerms.ps1

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
using namespace System.Net
2+
3+
Function Invoke-ExecModifyCalPerms {
4+
<#
5+
.FUNCTIONALITY
6+
Entrypoint
7+
.ROLE
8+
Exchange.Calendar.ReadWrite
9+
#>
10+
[CmdletBinding()]
11+
param($Request, $TriggerMetadata)
12+
13+
$APIName = $Request.Params.CIPPEndpoint
14+
Write-LogMessage -headers $Request.Headers -API $APINAME-message 'Accessed this API' -Sev 'Debug'
15+
16+
$Username = $request.body.userID
17+
$Tenantfilter = $request.body.tenantfilter
18+
$Permissions = $request.body.permissions
19+
20+
Write-LogMessage -headers $Request.Headers -API $APINAME-message "Processing request for user: $Username, tenant: $Tenantfilter" -Sev 'Debug'
21+
22+
if ($username -eq $null) {
23+
Write-LogMessage -headers $Request.Headers -API $APINAME-message 'Username is null' -Sev 'Error'
24+
$body = [pscustomobject]@{'Results' = @('Username is required') }
25+
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
26+
StatusCode = [HttpStatusCode]::BadRequest
27+
Body = $Body
28+
})
29+
return
30+
}
31+
32+
try {
33+
$userid = (New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users/$($username)" -tenantid $Tenantfilter).id
34+
Write-LogMessage -headers $Request.Headers -API $APINAME-message "Retrieved user ID: $userid" -Sev 'Debug'
35+
}
36+
catch {
37+
Write-LogMessage -headers $Request.Headers -API $APINAME-message "Failed to get user ID: $($_.Exception.Message)" -Sev 'Error'
38+
$body = [pscustomobject]@{'Results' = @("Failed to get user ID: $($_.Exception.Message)") }
39+
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
40+
StatusCode = [HttpStatusCode]::NotFound
41+
Body = $Body
42+
})
43+
return
44+
}
45+
46+
$Results = [System.Collections.ArrayList]::new()
47+
$HasErrors = $false
48+
49+
# Convert permissions to array format if it's an object with numeric keys
50+
if ($Permissions -is [PSCustomObject]) {
51+
if ($Permissions.PSObject.Properties.Name -match '^\d+$') {
52+
$Permissions = $Permissions.PSObject.Properties.Value
53+
}
54+
else {
55+
$Permissions = @($Permissions)
56+
}
57+
}
58+
59+
Write-LogMessage -headers $Request.Headers -API $APINAME-message "Processing $($Permissions.Count) permission entries" -Sev 'Debug'
60+
61+
foreach ($Permission in $Permissions) {
62+
Write-LogMessage -headers $Request.Headers -API $APINAME-message "Processing permission: $($Permission | ConvertTo-Json)" -Sev 'Debug'
63+
64+
$PermissionLevel = $Permission.PermissionLevel.value ?? $Permission.PermissionLevel
65+
$Modification = $Permission.Modification
66+
$CanViewPrivateItems = $Permission.CanViewPrivateItems ?? $false
67+
68+
Write-LogMessage -headers $Request.Headers -API $APINAME-message "Permission Level: $PermissionLevel, Modification: $Modification, CanViewPrivateItems: $CanViewPrivateItems" -Sev 'Debug'
69+
70+
# Handle UserID as array or single value
71+
$TargetUsers = @($Permission.UserID | ForEach-Object { $_.value ?? $_ })
72+
73+
Write-LogMessage -headers $Request.Headers -API $APINAME-message "Target Users: $($TargetUsers -join ', ')" -Sev 'Debug'
74+
75+
foreach ($TargetUser in $TargetUsers) {
76+
try {
77+
Write-LogMessage -headers $Request.Headers -API $APINAME-message "Processing target user: $TargetUser" -Sev 'Debug'
78+
79+
if ($Modification -eq 'Remove') {
80+
try {
81+
$CalPerms = New-ExoRequest -Anchor $username -tenantid $Tenantfilter -cmdlet 'Remove-MailboxFolderPermission' -cmdParams @{
82+
Identity = "$($userid):\Calendar"
83+
User = $TargetUser
84+
Confirm = $false
85+
}
86+
$null = $results.Add("Removed $($TargetUser) from $($username) Calendar permissions")
87+
}
88+
catch {
89+
$null = $results.Add("No existing permissions to remove for $($TargetUser)")
90+
}
91+
}
92+
else {
93+
Write-LogMessage -headers $Request.Headers -API $APINAME-message "Setting permissions with AccessRights: $PermissionLevel" -Sev 'Debug'
94+
95+
$cmdParams = @{
96+
Identity = "$($userid):\Calendar"
97+
User = $TargetUser
98+
AccessRights = $PermissionLevel
99+
Confirm = $false
100+
}
101+
102+
if ($CanViewPrivateItems) {
103+
$cmdParams['SharingPermissionFlags'] = 'Delegate,CanViewPrivateItems'
104+
}
105+
106+
try {
107+
# Try Add first
108+
$CalPerms = New-ExoRequest -Anchor $username -tenantid $Tenantfilter -cmdlet 'Add-MailboxFolderPermission' -cmdParams $cmdParams
109+
$null = $results.Add("Granted $($TargetUser) $($PermissionLevel) access to $($username) Calendar$($CanViewPrivateItems ? ' with access to private items' : '')")
110+
}
111+
catch {
112+
# If Add fails, try Set
113+
$CalPerms = New-ExoRequest -Anchor $username -tenantid $Tenantfilter -cmdlet 'Set-MailboxFolderPermission' -cmdParams $cmdParams
114+
$null = $results.Add("Updated $($TargetUser) $($PermissionLevel) access to $($username) Calendar$($CanViewPrivateItems ? ' with access to private items' : '')")
115+
}
116+
}
117+
Write-LogMessage -headers $Request.Headers -API $APINAME-message "Successfully executed $($PermissionLevel) permission modification for $($TargetUser) on $($username)" -Sev 'Info' -tenant $TenantFilter
118+
}
119+
catch {
120+
$HasErrors = $true
121+
Write-LogMessage -headers $Request.Headers -API $APINAME-message "Could not execute $($PermissionLevel) permission modification for $($TargetUser) on $($username). Error: $($_.Exception.Message)" -Sev 'Error' -tenant $TenantFilter
122+
$null = $results.Add("Could not execute $($PermissionLevel) permission modification for $($TargetUser) on $($username). Error: $($_.Exception.Message)")
123+
}
124+
}
125+
}
126+
127+
if ($results.Count -eq 0) {
128+
Write-LogMessage -headers $Request.Headers -API $APINAME-message 'No results were generated from the operation' -Sev 'Warning'
129+
$null = $results.Add('No results were generated from the operation. Please check the logs for more details.')
130+
$HasErrors = $true
131+
}
132+
133+
$body = [pscustomobject]@{'Results' = @($results) }
134+
135+
# Associate values to output bindings by calling 'Push-OutputBinding'.
136+
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
137+
StatusCode = if ($HasErrors) { [HttpStatusCode]::InternalServerError } else { [HttpStatusCode]::OK }
138+
Body = $Body
139+
})
140+
}

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecModifyMBPerms.ps1

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
using namespace System.Net
2+
3+
Function Invoke-ExecModifyMBPerms {
4+
<#
5+
.FUNCTIONALITY
6+
Entrypoint
7+
.ROLE
8+
Exchange.Mailbox.ReadWrite
9+
#>
10+
[CmdletBinding()]
11+
param($Request, $TriggerMetadata)
12+
13+
$APIName = $Request.Params.CIPPEndpoint
14+
Write-LogMessage -headers $Request.Headers -API $APINAME-message 'Accessed this API' -Sev 'Debug'
15+
16+
$Username = $request.body.userID
17+
$Tenantfilter = $request.body.tenantfilter
18+
$Permissions = $request.body.permissions
19+
20+
if ($username -eq $null) { exit }
21+
22+
$userid = (New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users/$($username)" -tenantid $Tenantfilter).id
23+
$Results = [System.Collections.ArrayList]::new()
24+
25+
# Convert permissions to array format if it's an object with numeric keys
26+
if ($Permissions -is [PSCustomObject]) {
27+
if ($Permissions.PSObject.Properties.Name -match '^\d+$') {
28+
$Permissions = $Permissions.PSObject.Properties.Value
29+
}
30+
else {
31+
$Permissions = @($Permissions)
32+
}
33+
}
34+
35+
foreach ($Permission in $Permissions) {
36+
$PermissionLevel = $Permission.PermissionLevel
37+
$Modification = $Permission.Modification
38+
$AutoMap = if ($Permission.PSObject.Properties.Name -contains 'AutoMap') { $Permission.AutoMap } else { $true }
39+
40+
# Handle UserID as array of objects or single value
41+
$TargetUsers = if ($Permission.UserID -is [array]) {
42+
$Permission.UserID | ForEach-Object { $_.value }
43+
}
44+
else {
45+
@($Permission.UserID)
46+
}
47+
48+
foreach ($TargetUser in $TargetUsers) {
49+
try {
50+
switch ($PermissionLevel) {
51+
'FullAccess' {
52+
if ($Modification -eq 'Remove') {
53+
$MailboxPerms = New-ExoRequest -Anchor $username -tenantid $Tenantfilter -cmdlet 'Remove-mailboxpermission' -cmdParams @{
54+
Identity = $userid
55+
user = $TargetUser
56+
accessRights = @('FullAccess')
57+
Confirm = $false
58+
}
59+
$null = $results.Add("Removed $($TargetUser) from $($username) Shared Mailbox permissions")
60+
}
61+
else {
62+
$MailboxPerms = New-ExoRequest -Anchor $username -tenantid $Tenantfilter -cmdlet 'Add-MailboxPermission' -cmdParams @{
63+
Identity = $userid
64+
user = $TargetUser
65+
accessRights = @('FullAccess')
66+
automapping = $AutoMap
67+
Confirm = $false
68+
}
69+
$null = $results.Add("Granted $($TargetUser) access to $($username) Mailbox with automapping set to $($AutoMap)")
70+
}
71+
}
72+
'SendAs' {
73+
if ($Modification -eq 'Remove') {
74+
$MailboxPerms = New-ExoRequest -Anchor $username -tenantid $Tenantfilter -cmdlet 'Remove-RecipientPermission' -cmdParams @{
75+
Identity = $userid
76+
Trustee = $TargetUser
77+
accessRights = @('SendAs')
78+
Confirm = $false
79+
}
80+
$null = $results.Add("Removed $($TargetUser) from $($username) with Send As permissions")
81+
}
82+
else {
83+
$MailboxPerms = New-ExoRequest -Anchor $username -tenantid $Tenantfilter -cmdlet 'Add-RecipientPermission' -cmdParams @{
84+
Identity = $userid
85+
Trustee = $TargetUser
86+
accessRights = @('SendAs')
87+
Confirm = $false
88+
}
89+
$null = $results.Add("Granted $($TargetUser) access to $($username) with Send As permissions")
90+
}
91+
}
92+
'SendOnBehalf' {
93+
if ($Modification -eq 'Remove') {
94+
$MailboxPerms = New-ExoRequest -Anchor $username -tenantid $Tenantfilter -cmdlet 'Set-Mailbox' -cmdParams @{
95+
Identity = $userid
96+
GrantSendonBehalfTo = @{
97+
'@odata.type' = '#Exchange.GenericHashTable'
98+
remove = $TargetUser
99+
}
100+
Confirm = $false
101+
}
102+
$null = $results.Add("Removed $($TargetUser) from $($username) Send on Behalf Permissions")
103+
}
104+
else {
105+
$MailboxPerms = New-ExoRequest -Anchor $username -tenantid $Tenantfilter -cmdlet 'Set-Mailbox' -cmdParams @{
106+
Identity = $userid
107+
GrantSendonBehalfTo = @{
108+
'@odata.type' = '#Exchange.GenericHashTable'
109+
add = $TargetUser
110+
}
111+
Confirm = $false
112+
}
113+
$null = $results.Add("Granted $($TargetUser) access to $($username) with Send On Behalf Permissions")
114+
}
115+
}
116+
}
117+
Write-LogMessage -headers $Request.Headers -API $APINAME-message "Executed $($PermissionLevel) permission modification for $($TargetUser) on $($username)" -Sev 'Info' -tenant $TenantFilter
118+
}
119+
catch {
120+
Write-LogMessage -headers $Request.Headers -API $APINAME-message "Could not execute $($PermissionLevel) permission modification for $($TargetUser) on $($username)" -Sev 'Error' -tenant $TenantFilter
121+
$null = $results.Add("Could not execute $($PermissionLevel) permission modification for $($TargetUser) on $($username). Error: $($_.Exception.Message)")
122+
}
123+
}
124+
}
125+
126+
$body = [pscustomobject]@{'Results' = @($results) }
127+
128+
# Associate values to output bindings by calling 'Push-OutputBinding'.
129+
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
130+
StatusCode = [HttpStatusCode]::OK
131+
Body = $Body
132+
})
133+
}

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-AddTransportRule.ps1

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
using namespace System.Net
22

3-
Function Invoke-AddTransportRule {
3+
function Invoke-AddTransportRule {
44
<#
55
.FUNCTIONALITY
6-
Entrypoint
6+
Entrypoint,AnyTenant
77
.ROLE
88
Exchange.TransportRule.ReadWrite
99
#>
@@ -17,6 +17,15 @@ Function Invoke-AddTransportRule {
1717
$RequestParams = $Request.Body.PowerShellCommand | ConvertFrom-Json | Select-Object -Property * -ExcludeProperty GUID, HasSenderOverride, ExceptIfHasSenderOverride, ExceptIfMessageContainsDataClassifications, MessageContainsDataClassifications
1818

1919
$Tenants = ($Request.body.selectedTenants).value
20+
21+
$AllowedTenants = Test-CippAccess -Request $Request -TenantList
22+
23+
if ($AllowedTenants -ne 'AllTenants') {
24+
$AllTenants = Get-Tenants -IncludeErrors
25+
$AllowedTenantList = $AllTenants | Where-Object { $_.customerId -in $AllowedTenants }
26+
$Tenants = $Tenants | Where-Object { $_ -in $AllowedTenantList.defaultDomainName }
27+
}
28+
2029
$Result = foreach ($tenantFilter in $tenants) {
2130
$Existing = New-ExoRequest -ErrorAction SilentlyContinue -tenantid $tenantFilter -cmdlet 'Get-TransportRule' -useSystemMailbox $true | Where-Object -Property Identity -EQ $RequestParams.name
2231
try {

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-AddStandardsTemplate.ps1

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,9 +29,8 @@ function Invoke-AddStandardsTemplate {
2929
RowKey = "$GUID"
3030
PartitionKey = 'StandardsTemplateV2'
3131
GUID = "$GUID"
32-
3332
}
34-
Write-LogMessage -headers $Request.Headers -API $APINAME -message "Created CA Template $($Request.body.name) with GUID $GUID" -Sev 'Debug'
33+
Write-LogMessage -headers $Request.Headers -API $APINAME -message "Standards Template $($Request.body.templateName) with GUID $GUID added/edited." -Sev 'Info'
3534
$body = [pscustomobject]@{'Results' = 'Successfully added template'; Metadata = @{id = $GUID } }
3635

3736
# Associate values to output bindings by calling 'Push-OutputBinding'.

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListStandardsCompare.ps1

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
using namespace System.Net
22

3-
Function Invoke-ListStandardsCompare {
3+
function Invoke-ListStandardsCompare {
44
<#
55
.FUNCTIONALITY
66
Entrypoint
@@ -10,7 +10,13 @@ Function Invoke-ListStandardsCompare {
1010
[CmdletBinding()]
1111
param($Request, $TriggerMetadata)
1212

13+
1314
$Table = Get-CIPPTable -TableName 'CippStandardsReports'
15+
$TenantFilter = $Request.Query.tenantFilter
16+
if ($TenantFilter) {
17+
$Table.Filter = "RowKey eq '{0}'" -f $TenantFilter
18+
}
19+
1420
$Results = Get-CIPPAzDataTableEntity @Table
1521

1622
#in the results we have objects starting with "standards." All these have to be converted from JSON. Do not do this is its a boolean

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-listStandardTemplates.ps1

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
using namespace System.Net
22

3-
Function Invoke-listStandardTemplates {
3+
function Invoke-listStandardTemplates {
44
<#
55
.FUNCTIONALITY
66
Entrypoint,AnyTenant
@@ -29,7 +29,11 @@ Function Invoke-listStandardTemplates {
2929
return
3030
}
3131
$Data | Add-Member -NotePropertyName 'GUID' -NotePropertyValue $_.GUID -Force
32-
if ($Data.excludedTenants) { $Data.excludedTenants = @($Data.excludedTenants) }
32+
if ($Data.excludedTenants -and $Data.excludedTenants -ne 'excludedTenants') {
33+
$Data.excludedTenants = @($Data.excludedTenants)
34+
} else {
35+
$Data.excludedTenants = @()
36+
}
3337
$Data
3438
} | Sort-Object -Property templateName
3539

0 commit comments

Comments
 (0)