Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-10-26 16:46:12 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: check privileges before exporting post/topic data

Browse Source
This commit is contained in:
Barış Soner Uşaklı
2020-05-15 15:44:39 -04:00
parent f0323b6cfa
commit 5fd81c5c04
1 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
src/controllers/user.js
View File

@@ -195,11 +195,11 @@ userController.exportProfile = async function (req, res) {
user.auth.getSessions(targetUid, req.sessionID),
user.getHistory('user:' + targetUid + ':usernames'),
user.getHistory('user:' + targetUid + ':emails'),
getSetData('uid:' + targetUid + ':bookmarks', 'post:'),
getSetData('uid:' + targetUid + ':followed_tids', 'topic:'),
getSetData('uid:' + targetUid + ':upvote', 'post:'),
getSetData('uid:' + targetUid + ':downvote', 'post:'),
getSetData('following:' + targetUid, 'user:'),
getSetData('uid:' + targetUid + ':bookmarks', 'post:', targetUid),
getSetData('uid:' + targetUid + ':followed_tids', 'topic:', targetUid),
getSetData('uid:' + targetUid + ':upvote', 'post:', targetUid),
getSetData('uid:' + targetUid + ':downvote', 'post:', targetUid),
getSetData('following:' + targetUid, 'user:', targetUid),
]);
delete userData.password;
const followingData = following.map(u => ({ username: u.username, uid: u.uid }));
@@ -239,15 +239,19 @@ async function getRoomMessages(uid, roomId) {
return data;
}
async function getSetData(set, keyPrefix) {
async function getSetData(set, keyPrefix, uid) {
let data = [];
await batch.processSortedSet(set, async (ids) => {
data = data.concat(await db.getObjects(ids.map(mid => keyPrefix + mid)));
if (keyPrefix === 'post:') {
ids = await privileges.posts.filter('topics:read', ids, uid);
} else if (keyPrefix === 'topic:') {
ids = await privileges.topics.filterTids('topics:read', ids, uid);
}
data = data.concat(await db.getObjects(ids.map(id => keyPrefix + id)));
}, { batch: 500 });
return data;
}
require('../promisify')(userController, [
'getCurrentUser', 'getUserByUID', 'getUserByUsername', 'getUserByEmail',
'exportPosts', 'exportUploads', 'exportProfile',