Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-11-01 19:46:01 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: use admin:groups priv for groups (#10960)

Browse Source
This commit is contained in:
Barış Soner Uşaklı
2022-10-12 10:02:45 -04:00
committed by GitHub
parent e35b0a869f
commit b879b6a0c2
2 changed files with 15 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/api/groups.js
View File

@@ -215,14 +215,14 @@ async function isOwner(caller, groupName) {
if (typeof groupName !== 'string') { if (typeof groupName !== 'string') {
throw new Error('[[error:invalid-group-name]]'); throw new Error('[[error:invalid-group-name]]');
} }
const [isAdmin, isGlobalModerator, isOwner, group] = await Promise.all([ const [hasAdminPrivilege, isGlobalModerator, isOwner, group] = await Promise.all([
user.isAdministrator(caller.uid), privileges.admin.can('admin:groups', caller.uid),
user.isGlobalModerator(caller.uid), user.isGlobalModerator(caller.uid),
groups.ownership.isOwner(caller.uid, groupName), groups.ownership.isOwner(caller.uid, groupName),
groups.getGroupData(groupName), groups.getGroupData(groupName),
]); ]);
const check = isOwner || isAdmin || (isGlobalModerator && !group.system); const check = isOwner || hasAdminPrivilege || (isGlobalModerator && !group.system);
if (!check) { if (!check) {
throw new Error('[[error:no-privileges]]'); throw new Error('[[error:no-privileges]]');
} }

22
src/socket.io/groups.js
View File

@@ -42,13 +42,15 @@ async function isOwner(socket, data) {
throw new Error('[[error:invalid-group-name]]'); throw new Error('[[error:invalid-group-name]]');
} }
const results = await utils.promiseParallel({ const results = await utils.promiseParallel({
isAdmin: await user.isAdministrator(socket.uid), hasAdminPrivilege: privileges.admin.can('admin:groups', socket.uid),
isGlobalModerator: await user.isGlobalModerator(socket.uid), isGlobalModerator: user.isGlobalModerator(socket.uid),
isOwner: await groups.ownership.isOwner(socket.uid, data.groupName), isOwner: groups.ownership.isOwner(socket.uid, data.groupName),
group: await groups.getGroupData(data.groupName), group: groups.getGroupData(data.groupName),
}); });
const isOwner = results.isOwner || results.isAdmin || (results.isGlobalModerator && !results.group.system); const isOwner = results.isOwner ||
results.hasAdminPrivilege ||
(results.isGlobalModerator && !results.group.system);
if (!isOwner) { if (!isOwner) {
throw new Error('[[error:no-privileges]]'); throw new Error('[[error:no-privileges]]');
} }
@@ -220,15 +222,15 @@ SocketGroups.loadMoreMembers = async (socket, data) => {
}; };
async function canSearchMembers(uid, groupName) { async function canSearchMembers(uid, groupName) {
const [isHidden, isMember, isAdmin, isGlobalMod, viewGroups] = await Promise.all([ const [isHidden, isMember, hasAdminPrivilege, isGlobalMod, viewGroups] = await Promise.all([
groups.isHidden(groupName), groups.isHidden(groupName),
groups.isMember(uid, groupName), groups.isMember(uid, groupName),
user.isAdministrator(uid), privileges.admin.can('admin:groups', uid),
user.isGlobalModerator(uid), user.isGlobalModerator(uid),
privileges.global.can('view:groups', uid), privileges.global.can('view:groups', uid),
]); ]);
if (!viewGroups || (isHidden && !isMember && !isAdmin && !isGlobalMod)) { if (!viewGroups || (isHidden && !isMember && !hasAdminPrivilege && !isGlobalMod)) {
throw new Error('[[error:no-privileges]]'); throw new Error('[[error:no-privileges]]');
} }
} }
@@ -268,11 +270,11 @@ async function canModifyGroup(uid, groupName) {
const results = await utils.promiseParallel({ const results = await utils.promiseParallel({
isOwner: groups.ownership.isOwner(uid, groupName), isOwner: groups.ownership.isOwner(uid, groupName),
system: groups.getGroupField(groupName, 'system'), system: groups.getGroupField(groupName, 'system'),
isAdmin: user.isAdministrator(uid), hasAdminPrivilege: privileges.admin.can('admin:groups', uid),
isGlobalMod: user.isGlobalModerator(uid), isGlobalMod: user.isGlobalModerator(uid),
}); });
if (!(results.isOwner || results.isAdmin || (results.isGlobalMod && !results.system))) { if (!(results.isOwner || results.hasAdminPrivilege || (results.isGlobalMod && !results.system))) {
throw new Error('[[error:no-privileges]]'); throw new Error('[[error:no-privileges]]');
} }
} }