Fix org manager check on export (#1906)

* Fix org manager check on export

* Fix filter typo from collection to cipher

src/Api/Controllers/CiphersController.cs

@@ -224,12 +224,17 @@ namespace Bit.Api.Controllers
                 throw new NotFoundException();
             }
 
-            var ciphers = await _cipherRepository.GetManyByOrganizationIdAsync(orgIdGuid);
+            var ciphers = await _cipherRepository.GetManyByUserIdAsync(userId, true);
+            var orgCiphers = ciphers.Where(c => c.OrganizationId == orgIdGuid);
+            var orgCipherIds = orgCiphers.Select(c => c.Id);
 
             var collectionCiphers = await _collectionCipherRepository.GetManyByOrganizationIdAsync(orgIdGuid);
-            var collectionCiphersGroupDict = collectionCiphers.GroupBy(c => c.CipherId).ToDictionary(s => s.Key);
+            var collectionCiphersGroupDict = collectionCiphers
+                .Where(c => orgCipherIds.Contains(c.CipherId))
+                .GroupBy(c => c.CipherId).ToDictionary(s => s.Key);
 
-            var responses = ciphers.Select(c => new CipherMiniDetailsResponseModel(c, _globalSettings,
+
+            var responses = orgCiphers.Select(c => new CipherMiniDetailsResponseModel(c, _globalSettings,
                 collectionCiphersGroupDict));
 
             var providerId = await _currentContext.ProviderIdForOrg(orgIdGuid);

src/Api/Controllers/CollectionsController.cs

@@ -87,8 +87,9 @@ namespace Bit.Api.Controllers
                 throw new NotFoundException();
             }
 
-            var collections = await _collectionRepository.GetManyByOrganizationIdAsync(orgIdGuid);
-            var responses = collections.Select(c => new CollectionResponseModel(c));
+            var collections = await _collectionRepository.GetManyByUserIdAsync(_currentContext.UserId.Value);
+            var orgCollections = collections.Where(c => c.OrganizationId == orgIdGuid);
+            var responses = orgCollections.Select(c => new CollectionResponseModel(c));
             return new ListResponseModel<CollectionResponseModel>(responses);
         }