Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-10-31 02:55:58 +01:00
Code Issues Packages Projects Releases Wiki Activity

Priv hook fix (#9775)

Browse Source 
* fix: #9773, fire hooks properly for priv changes

* fix: admin/global group privs

dont allow invalid privs
This commit is contained in:
Barış Soner Uşaklı
2021-09-03 11:58:17 -04:00
committed by GitHub
parent 4ac701d747
commit 1f91a31327
3 changed files with 14 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
src/api/categories.js
View File

@@ -70,15 +70,19 @@ categoriesAPI.setPrivilege = async (caller, data) => {
if (!privs.length) { if (!privs.length) {
throw new Error('[[error:invalid-data]]'); throw new Error('[[error:invalid-data]]');
} }
let privMethod = privileges.categories[type];
if (parseInt(data.cid, 10) === 0) { if (parseInt(data.cid, 10) === 0) {
if (privs[0].startsWith('admin:')) { const adminPrivs = privs.filter(priv => privileges.admin.privilegeList.includes(priv));
privMethod = privileges.admin[type]; const globalPrivs = privs.filter(priv => privileges.global.privilegeList.includes(priv));
} else { if (adminPrivs.length) {
privMethod = privileges.global[type]; await privileges.admin[type](adminPrivs, data.member);
} }
if (globalPrivs.length) {
await privileges.global[type](globalPrivs, data.member);
}
} else {
const categoryPrivs = privs.filter(priv => privileges.categories.privilegeList.includes(priv));
await privileges.categories[type](categoryPrivs, data.cid, data.member);
} }
await privMethod(privs, data.cid, data.member);
await events.log({ await events.log({
uid: caller.uid, uid: caller.uid,

2
src/privileges/admin.js
View File

@@ -35,6 +35,8 @@ privsAdmin.userPrivilegeList = [
privsAdmin.groupPrivilegeList = privsAdmin.userPrivilegeList.map(privilege => `groups:${privilege}`); privsAdmin.groupPrivilegeList = privsAdmin.userPrivilegeList.map(privilege => `groups:${privilege}`);
privsAdmin.privilegeList = privsAdmin.userPrivilegeList.concat(privsAdmin.groupPrivilegeList);
// Mapping for a page route (via direct match or regexp) to a privilege // Mapping for a page route (via direct match or regexp) to a privilege
privsAdmin.routeMap = { privsAdmin.routeMap = {
dashboard: 'admin:dashboard', dashboard: 'admin:dashboard',

2
src/privileges/global.js
View File

@@ -49,6 +49,8 @@ privsGlobal.userPrivilegeList = [
privsGlobal.groupPrivilegeList = privsGlobal.userPrivilegeList.map(privilege => `groups:${privilege}`); privsGlobal.groupPrivilegeList = privsGlobal.userPrivilegeList.map(privilege => `groups:${privilege}`);
privsGlobal.privilegeList = privsGlobal.userPrivilegeList.concat(privsGlobal.groupPrivilegeList);
privsGlobal.list = async function () { privsGlobal.list = async function () {
async function getLabels() { async function getLabels() {
return await utils.promiseParallel({ return await utils.promiseParallel({