Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-10-26 08:36:12 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: #9670 return 4xx errors instead of 5xx on flag routes, when unauthenticated or not privileged [breaking]

Browse Source
This commit is contained in:
Julian Lam
2021-07-21 13:27:21 -04:00
parent 6c47a060c1
commit d1959a258b
2 changed files with 5 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/controllers/helpers.js
View File

@@ -117,11 +117,7 @@ helpers.buildTerms = function (url, term, query) {
};
helpers.notAllowed = async function (req, res, error) {
const data = await plugins.hooks.fire('filter:helpers.notAllowed', {
req: req,
res: res,
error: error,
});
({ error } = await plugins.hooks.fire('filter:helpers.notAllowed', { req, res, error }));
if (req.loggedIn || req.uid === -1) {
if (res.locals.isAPI) {
@@ -132,7 +128,7 @@ helpers.notAllowed = async function (req, res, error) {
res.status(403).render('403', {
path: req.path,
loggedIn: req.loggedIn,
error: data.error,
error,
title: '[[global:403.title]]',
});
}

8
src/controllers/mods.js
View File

@@ -27,7 +27,7 @@ modsController.flags.list = async function (req, res, next) {
let [,, { filters }] = results;
if (!(isAdminOrGlobalMod || !!moderatedCids.length)) {
return next(new Error('[[error:no-privileges]]'));
return helpers.notAllowed(req, res);
}
if (!isAdminOrGlobalMod && moderatedCids.length) {
@@ -113,10 +113,8 @@ modsController.flags.detail = async function (req, res, next) {
});
results.privileges = { ...results.privileges[0], ...results.privileges[1] };
if (!results.flagData) {
return next(new Error('[[error:invalid-data]]'));
} else if (!(results.isAdminOrGlobalMod || !!results.moderatedCids.length)) {
return next(new Error('[[error:no-privileges]]'));
if (!results.flagData || (!(results.isAdminOrGlobalMod || !!results.moderatedCids.length))) {
return next(); // 404
}
if (results.flagData.type === 'user') {