[bug] Able to query default templates of other organizations

[pandafy]

The code for get_default_templates does not check whether currently logged in user manages the organization for which templates are being queried. Hence, it is possible to query templates for other organizations as well. Adding a check like if organization_id in user.organizations_managed should solve this.

openwisp-controller/openwisp_controller/config/views.py

Lines 19 to 33 in 7806457

	def get_default_templates(request, organization_id):
	"""
	returns default templates of specified organization
	"""
	backend = request.GET.get("backend", None)
	user = request.user
	authenticated = user.is_authenticated
	if not authenticated and not user.is_staff:
	return HttpResponse(status=403)
	org = get_object_or_404(Organization, pk=organization_id, is_active=True)
	templates = get_default_templates_queryset(org.pk, backend, model=Template).only(
	'id'
	)
	uuids = [str(t.pk) for t in templates]
	return JsonResponse({'default_templates': uuids})

Found in #398 (comment)