WebPlay/server
1
1
Fork 0
Code Issues 7 Pull Requests Packages Projects Releases Wiki Activity

protect shared items collection fix #4
All checks were successful
continuous-integration/drone/push Build is passing
Details

Browse Source
This commit is contained in:
Artem Anufrij 2023-02-17 22:20:09 +01:00
parent 708d657cc3
commit 6c43cf5f62
2 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
router/share.js
View File

@ -8,9 +8,13 @@ var passport = server.passport;
router.route("/") router.route("/")
.get(passport.authenticate("jwt", { session: false }), (req, res) => { .get(passport.authenticate("jwt", { session: false }), (req, res) => {
database.share.collection(result => { if (req.user.roles.includes("admin")) {
res.json(result).status(200).end(); database.share.collection(result => {
}) res.json(result).status(200).end();
})
} else {
res.status(403).end();
}
}); });
router.route("/:id") router.route("/:id")
.get((req, res) => { .get((req, res) => {

6
router/system.js
View File

@ -19,7 +19,7 @@ router
}) })
}) })
.post(passport.authenticate("jwt", { session: false }), (req, res) => { .post(passport.authenticate("jwt", { session: false }), (req, res) => {
if (req.user.roles.indexOf("admin") > -1) { if (req.user.roles.includes("admin")) {
database.system.setAllows(req.body, () => { database.system.setAllows(req.body, () => {
res.status(200).end(); res.status(200).end();
}) })
@ -31,7 +31,7 @@ router
router router
.route("/domains") .route("/domains")
.get(passport.authenticate("jwt", { session: false }), (req, res) => { .get(passport.authenticate("jwt", { session: false }), (req, res) => {
if (req.user.roles.indexOf("admin") > -1) { if (req.user.roles.includes("admin")) {
let domains = { let domains = {
const: config.allowed_domains, const: config.allowed_domains,
dynamic: [] dynamic: []
@ -47,7 +47,7 @@ router
} }
}) })
.post(passport.authenticate("jwt", { session: false }), (req, res) => { .post(passport.authenticate("jwt", { session: false }), (req, res) => {
if (req.user.roles.indexOf("admin") > -1) { if (req.user.roles.includes("admin")) {
database.system.setDomains(req.body, () => { database.system.setDomains(req.body, () => {
res.status(200).end(); res.status(200).end();
}); });