WebPlay/server
1
1
Fork 0
Code Issues 7 Pull Requests Packages Projects Releases Wiki Activity

Merge pull request 'protect shared items collection' (#6) from dev into main
All checks were successful
continuous-integration/drone/push Build is passing
Details

Browse Source 
Reviewed-on: #6
This commit is contained in:
Artem Anufrij 2023-02-17 22:23:16 +01:00
commit 2d1e117b66
3 changed files with 14 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
.drone.yml
View File

@ -21,3 +21,6 @@ steps:
when: when:
branch: branch:
- main - main
event:
exclude:
- pull_request

4
router/share.js
View File

@ -8,9 +8,13 @@ var passport = server.passport;
router.route("/") router.route("/")
.get(passport.authenticate("jwt", { session: false }), (req, res) => { .get(passport.authenticate("jwt", { session: false }), (req, res) => {
if (req.user.roles.includes("admin")) {
database.share.collection(result => { database.share.collection(result => {
res.json(result).status(200).end(); res.json(result).status(200).end();
}) })
} else {
res.status(403).end();
}
}); });
router.route("/:id") router.route("/:id")
.get((req, res) => { .get((req, res) => {

6
router/system.js
View File

@ -19,7 +19,7 @@ router
}) })
}) })
.post(passport.authenticate("jwt", { session: false }), (req, res) => { .post(passport.authenticate("jwt", { session: false }), (req, res) => {
if (req.user.roles.indexOf("admin") > -1) { if (req.user.roles.includes("admin")) {
database.system.setAllows(req.body, () => { database.system.setAllows(req.body, () => {
res.status(200).end(); res.status(200).end();
}) })
@ -31,7 +31,7 @@ router
router router
.route("/domains") .route("/domains")
.get(passport.authenticate("jwt", { session: false }), (req, res) => { .get(passport.authenticate("jwt", { session: false }), (req, res) => {
if (req.user.roles.indexOf("admin") > -1) { if (req.user.roles.includes("admin")) {
let domains = { let domains = {
const: config.allowed_domains, const: config.allowed_domains,
dynamic: [] dynamic: []
@ -47,7 +47,7 @@ router
} }
}) })
.post(passport.authenticate("jwt", { session: false }), (req, res) => { .post(passport.authenticate("jwt", { session: false }), (req, res) => {
if (req.user.roles.indexOf("admin") > -1) { if (req.user.roles.includes("admin")) {
database.system.setDomains(req.body, () => { database.system.setDomains(req.body, () => {
res.status(200).end(); res.status(200).end();
}); });