Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-10-27 17:16:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: group create/join/update name validation

Browse Source
This commit is contained in:
Barış Soner Uşaklı
2020-01-07 15:40:54 -05:00
parent 48f086279c
commit 61da8c29ac
4 changed files with 136 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
src/socket.io/groups.js
View File

@@ -22,6 +22,10 @@ SocketGroups.join = async (socket, data) => {
throw new Error('[[error:invalid-uid]]');
}
if (typeof data.groupName !== 'string') {
throw new Error('[[error:invalid-group-name]]');
}
if (data.groupName === 'administrators' || groups.isPrivilegeGroup(data.groupName)) {
throw new Error('[[error:not-allowed]]');
}
@@ -66,6 +70,10 @@ SocketGroups.leave = async (socket, data) => {
throw new Error('[[error:invalid-uid]]');
}
if (typeof data.groupName !== 'string') {
throw new Error('[[error:invalid-group-name]]');
}
if (data.groupName === 'administrators') {
throw new Error('[[error:cant-remove-self-as-admin]]');
}
@@ -104,6 +112,9 @@ SocketGroups.addMember = async (socket, data) => {
};
async function isOwner(socket, data) {
if (typeof data.groupName !== 'string') {
throw new Error('[[error:invalid-group-name]]');
}
const results = await utils.promiseParallel({
isAdmin: await user.isAdministrator(socket.uid),
isGlobalModerator: await user.isGlobalModerator(socket.uid),
@@ -118,6 +129,9 @@ async function isOwner(socket, data) {
}
async function isInvited(socket, data) {
if (typeof data.groupName !== 'string') {
throw new Error('[[error:invalid-group-name]]');
}
const invited = await groups.isInvited(socket.uid, data.groupName);
if (!invited) {
throw new Error('[[error:not-invited]]');
@@ -171,6 +185,9 @@ SocketGroups.rejectAll = async (socket, data) => {
};
async function acceptRejectAll(method, socket, data) {
if (typeof data.groupName !== 'string') {
throw new Error('[[error:invalid-group-name]]');
}
const uids = await groups.getPending(data.groupName);
await Promise.all(uids.map(async (uid) => {
await method(socket, { groupName: data.groupName, toUid: uid });
@@ -251,7 +268,7 @@ SocketGroups.kick = async (socket, data) => {
SocketGroups.create = async (socket, data) => {
if (!socket.uid) {
throw new Error('[[error:no-privileges]]');
} else if (groups.isPrivilegeGroup(data.name)) {
} else if (typeof data.name !== 'string' || groups.isPrivilegeGroup(data.name)) {
throw new Error('[[error:invalid-group-name]]');
}
@@ -260,6 +277,7 @@ SocketGroups.create = async (socket, data) => {
throw new Error('[[error:no-privileges]]');
}
data.ownerUid = socket.uid;
data.system = false;
const groupData = await groups.create(data);
logGroupEvent(socket, 'group-create', {
groupName: data.name,
@@ -338,7 +356,6 @@ SocketGroups.cover.update = async (socket, data) => {
if (!socket.uid) {
throw new Error('[[error:no-privileges]]');
}
await canModifyGroup(socket.uid, data.groupName);
return await groups.updateCover(socket.uid, data);
};
@@ -353,6 +370,9 @@ SocketGroups.cover.remove = async (socket, data) => {
};
async function canModifyGroup(uid, groupName) {
if (typeof groupName !== 'string') {
throw new Error('[[error:invalid-group-name]]');
}
const results = await utils.promiseParallel({
isOwner: groups.ownership.isOwner(uid, groupName),
isAdminOrGlobalMod: user.isAdminOrGlobalMod(uid),