Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-11-02 20:16:04 +01:00
Code Issues Packages Projects Releases Wiki Activity

fixing issue where nojs mode of a private category would show the category topics, even if the requesting user was not allowed inside

Browse Source
This commit is contained in:
Julian Lam
2014-01-08 15:09:24 -05:00
parent 127261100e
commit ab16b1184d
1 changed files with 21 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
src/webserver.js
View File

@@ -16,6 +16,7 @@ var path = require('path'),
db = require('./database'), db = require('./database'),
user = require('./user'), user = require('./user'),
categories = require('./categories'), categories = require('./categories'),
CategoryTools = require('./categoryTools'),
posts = require('./posts'), posts = require('./posts'),
topics = require('./topics'), topics = require('./topics'),
ThreadTools = require('./threadTools'), ThreadTools = require('./threadTools'),
@@ -511,7 +512,7 @@ if(nconf.get('ssl')) {
async.waterfall([ async.waterfall([
function(next) { function(next) {
// Check whether this user is allowed to access this topic // Check whether this user is allowed to access this topic
ThreadTools.privileges(tid, ((req.user) ? req.user.uid : 0), function(err, privileges) { ThreadTools.privileges(tid, ((req.user) ? req.user.uid || 0 : 0), function(err, privileges) {
if (!err) { if (!err) {
if (!privileges.read) { if (!privileges.read) {
next(new Error('not-enough-privileges')); next(new Error('not-enough-privileges'));
@@ -671,6 +672,20 @@ if(nconf.get('ssl')) {
} }
async.waterfall([ async.waterfall([
function(next) {
// Check whether this user is allowed to access this category
CategoryTools.privileges(cid, ((req.user) ? req.user.uid || 0 : 0), function(err, privileges) {
if (!err) {
if (!privileges.read) {
next(new Error('not-enough-privileges'));
} else {
next();
}
} else {
next(err);
}
});
},
function (next) { function (next) {
categories.getCategoryById(cid, 0, function (err, categoryData) { categories.getCategoryById(cid, 0, function (err, categoryData) {
@@ -717,7 +732,11 @@ if(nconf.get('ssl')) {
} }
], function (err, data) { ], function (err, data) {
if (err) { if (err) {
return res.redirect('404'); if (err.message === 'not-enough-privileges') {
return res.redirect('403');
} else {
return res.redirect('404');
}
} }
if(data.categories.link) { if(data.categories.link) {