Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-10-27 17:16:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: dont allow searching by email/ip if not privileged

Browse Source
This commit is contained in:
Barış Soner Uşaklı
2020-07-04 16:43:44 -04:00
parent fef04fcf6b
commit ac6b571ed5
3 changed files with 10 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
public/src/client/chats/search.js
View File

@@ -28,6 +28,7 @@ define('forum/chats/search', ['components'], function (components) {
socket.emit('user.search', { socket.emit('user.search', {
query: username, query: username,
searchBy: 'username', searchBy: 'username',
paginate: false,
}, function (err, data) { }, function (err, data) {
if (err) { if (err) {
return app.alertError(err.message); return app.alertError(err.message);

12
src/controllers/users.js
View File

@@ -30,10 +30,14 @@ usersController.index = async function (req, res, next) {
} }
}; };
usersController.search = async function (req, res, next) { usersController.search = async function (req, res) {
const allowed = await privileges.global.can('search:users', req.uid); const [allowed, isPrivileged] = await Promise.all([
if (!allowed) { privileges.global.can('search:users', req.uid),
return next(new Error('[[error:no-privileges]]')); user.isPrivileged(req.uid),
]);
if (!allowed || ((req.query.searchBy === 'ip' || req.query.searchBy === 'email' || req.query.bannedOnly === 'true' || req.query.flaggedOnly === 'true') && !isPrivileged)) {
throw new Error('[[error:no-privileges]]');
} }
const [searchData, isAdminOrGlobalMod] = await Promise.all([ const [searchData, isAdminOrGlobalMod] = await Promise.all([
user.search({ user.search({

2
src/socket.io/user/search.js
View File

@@ -14,7 +14,7 @@ module.exports = function (SocketUser) {
user.isPrivileged(socket.uid), user.isPrivileged(socket.uid),
]); ]);
if (!allowed || ((data.searchBy === 'ip' || data.bannedOnly || data.flaggedOnly) && !isPrivileged)) { if (!allowed || ((data.searchBy === 'ip' || data.searchBy === 'email' || data.bannedOnly || data.flaggedOnly) && !isPrivileged)) {
throw new Error('[[error:no-privileges]]'); throw new Error('[[error:no-privileges]]');
} }
const result = await user.search({ const result = await user.search({