Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-11-02 20:16:04 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: dont allow searching by email/ip if not privileged

Browse Source
This commit is contained in:
Barış Soner Uşaklı
2020-07-04 16:43:44 -04:00
parent fef04fcf6b
commit ac6b571ed5
3 changed files with 10 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/controllers/users.js
View File

@@ -30,10 +30,14 @@ usersController.index = async function (req, res, next) {
}
};
usersController.search = async function (req, res, next) {
const allowed = await privileges.global.can('search:users', req.uid);
if (!allowed) {
return next(new Error('[[error:no-privileges]]'));
usersController.search = async function (req, res) {
const [allowed, isPrivileged] = await Promise.all([
privileges.global.can('search:users', req.uid),
user.isPrivileged(req.uid),
]);
if (!allowed || ((req.query.searchBy === 'ip' || req.query.searchBy === 'email' || req.query.bannedOnly === 'true' || req.query.flaggedOnly === 'true') && !isPrivileged)) {
throw new Error('[[error:no-privileges]]');
}
const [searchData, isAdminOrGlobalMod] = await Promise.all([
user.search({