Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-10-26 08:36:12 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: check privileges before exporting post/topic data

Browse Source
This commit is contained in:
Barış Soner Uşaklı
2020-05-15 15:44:39 -04:00
parent f0323b6cfa
commit 5fd81c5c04
1 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
src/controllers/user.js
View File

@@ -195,11 +195,11 @@ userController.exportProfile = async function (req, res) {
user.auth.getSessions(targetUid, req.sessionID), user.auth.getSessions(targetUid, req.sessionID),
user.getHistory('user:' + targetUid + ':usernames'), user.getHistory('user:' + targetUid + ':usernames'),
user.getHistory('user:' + targetUid + ':emails'), user.getHistory('user:' + targetUid + ':emails'),
getSetData('uid:' + targetUid + ':bookmarks', 'post:'), getSetData('uid:' + targetUid + ':bookmarks', 'post:', targetUid),
getSetData('uid:' + targetUid + ':followed_tids', 'topic:'), getSetData('uid:' + targetUid + ':followed_tids', 'topic:', targetUid),
getSetData('uid:' + targetUid + ':upvote', 'post:'), getSetData('uid:' + targetUid + ':upvote', 'post:', targetUid),
getSetData('uid:' + targetUid + ':downvote', 'post:'), getSetData('uid:' + targetUid + ':downvote', 'post:', targetUid),
getSetData('following:' + targetUid, 'user:'), getSetData('following:' + targetUid, 'user:', targetUid),
]); ]);
delete userData.password; delete userData.password;
const followingData = following.map(u => ({ username: u.username, uid: u.uid })); const followingData = following.map(u => ({ username: u.username, uid: u.uid }));
@@ -239,15 +239,19 @@ async function getRoomMessages(uid, roomId) {
return data; return data;
} }
async function getSetData(set, keyPrefix) { async function getSetData(set, keyPrefix, uid) {
let data = []; let data = [];
await batch.processSortedSet(set, async (ids) => { await batch.processSortedSet(set, async (ids) => {
data = data.concat(await db.getObjects(ids.map(mid => keyPrefix + mid))); if (keyPrefix === 'post:') {
ids = await privileges.posts.filter('topics:read', ids, uid);
} else if (keyPrefix === 'topic:') {
ids = await privileges.topics.filterTids('topics:read', ids, uid);
}
data = data.concat(await db.getObjects(ids.map(id => keyPrefix + id)));
}, { batch: 500 }); }, { batch: 500 });
return data; return data;
} }
require('../promisify')(userController, [ require('../promisify')(userController, [
'getCurrentUser', 'getUserByUID', 'getUserByUsername', 'getUserByEmail', 'getCurrentUser', 'getUserByUID', 'getUserByUsername', 'getUserByEmail',
'exportPosts', 'exportUploads', 'exportProfile', 'exportPosts', 'exportUploads', 'exportProfile',