Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-11-01 11:35:55 +01:00
Code Issues Packages Projects Releases Wiki Activity

check privs on composer.push

Browse Source
This commit is contained in:
barisusakli
2014-11-25 23:08:28 -05:00
parent 916f1c7ce1
commit 51436fd2d9
1 changed files with 41 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

74
src/socket.io/modules.js
View File

@@ -1,6 +1,12 @@
"use strict"; "use strict";
var posts = require('../posts'), var nconf = require('nconf'),
async = require('async'),
S = require('string'),
winston = require('winston'),
_ = require('underscore'),
posts = require('../posts'),
postTools = require('../postTools'), postTools = require('../postTools'),
topics = require('../topics'), topics = require('../topics'),
meta = require('../meta'), meta = require('../meta'),
@@ -9,13 +15,10 @@ var posts = require('../posts'),
notifications = require('../notifications'), notifications = require('../notifications'),
plugins = require('../plugins'), plugins = require('../plugins'),
utils = require('../../public/src/utils'), utils = require('../../public/src/utils'),
privileges = require('../privileges'),
async = require('async'),
S = require('string'),
winston = require('winston'),
_ = require('underscore'),
server = require('./'), server = require('./'),
nconf = require('nconf'),
SocketModules = { SocketModules = {
composer: {}, composer: {},
@@ -28,37 +31,42 @@ var posts = require('../posts'),
/* Posts Composer */ /* Posts Composer */
SocketModules.composer.push = function(socket, pid, callback) { SocketModules.composer.push = function(socket, pid, callback) {
posts.getPostFields(pid, ['content', 'tid'], function(err, postData) { privileges.posts.can('read', pid, socket.uid, function(err, canRead) {
if(err || (!postData && !postData.content)) { if (err || !canRead) {
return callback(err || new Error('[[error:invalid-pid]]')); return callback(err || new Error('[[error:no-privileges]]'));
} }
posts.getPostFields(pid, ['content', 'tid'], function(err, postData) {
async.parallel({ if(err || (!postData && !postData.content)) {
topic: function(next) { return callback(err || new Error('[[error:invalid-pid]]'));
topics.getTopicDataByPid(pid, next);
},
tags: function(next) {
topics.getTopicTags(postData.tid, next);
},
isMain: function(next) {
posts.isMain(pid, next);
}
}, function(err, results) {
if(err) {
return callback(err);
} }
if (!results.topic) { async.parallel({
return callback(new Error('[[error:no-topic]]')); topic: function(next) {
} topics.getTopicDataByPid(pid, next);
},
tags: function(next) {
topics.getTopicTags(postData.tid, next);
},
isMain: function(next) {
posts.isMain(pid, next);
}
}, function(err, results) {
if(err) {
return callback(err);
}
callback(null, { if (!results.topic) {
pid: pid, return callback(new Error('[[error:no-topic]]'));
body: postData.content, }
title: results.topic.title,
topic_thumb: results.topic.thumb, callback(null, {
tags: results.tags, pid: pid,
isMain: results.isMain body: postData.content,
title: results.topic.title,
topic_thumb: results.topic.thumb,
tags: results.tags,
isMain: results.isMain
});
}); });
}); });
}); });