Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-10-26 08:36:12 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: #9670 return 4xx errors instead of 5xx on flag routes, when unauthenticated or not privileged [breaking]

Browse Source
This commit is contained in:
Julian Lam
2021-07-21 13:27:21 -04:00
parent 6c47a060c1
commit d1959a258b
2 changed files with 5 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/controllers/helpers.js
View File

@@ -117,11 +117,7 @@ helpers.buildTerms = function (url, term, query) {
}; };
helpers.notAllowed = async function (req, res, error) { helpers.notAllowed = async function (req, res, error) {
const data = await plugins.hooks.fire('filter:helpers.notAllowed', { ({ error } = await plugins.hooks.fire('filter:helpers.notAllowed', { req, res, error }));
req: req,
res: res,
error: error,
});
if (req.loggedIn || req.uid === -1) { if (req.loggedIn || req.uid === -1) {
if (res.locals.isAPI) { if (res.locals.isAPI) {
@@ -132,7 +128,7 @@ helpers.notAllowed = async function (req, res, error) {
res.status(403).render('403', { res.status(403).render('403', {
path: req.path, path: req.path,
loggedIn: req.loggedIn, loggedIn: req.loggedIn,
error: data.error, error,
title: '[[global:403.title]]', title: '[[global:403.title]]',
}); });
} }

8
src/controllers/mods.js
View File

@@ -27,7 +27,7 @@ modsController.flags.list = async function (req, res, next) {
let [,, { filters }] = results; let [,, { filters }] = results;
if (!(isAdminOrGlobalMod || !!moderatedCids.length)) { if (!(isAdminOrGlobalMod || !!moderatedCids.length)) {
return next(new Error('[[error:no-privileges]]')); return helpers.notAllowed(req, res);
} }
if (!isAdminOrGlobalMod && moderatedCids.length) { if (!isAdminOrGlobalMod && moderatedCids.length) {
@@ -113,10 +113,8 @@ modsController.flags.detail = async function (req, res, next) {
}); });
results.privileges = { ...results.privileges[0], ...results.privileges[1] }; results.privileges = { ...results.privileges[0], ...results.privileges[1] };
if (!results.flagData) { if (!results.flagData || (!(results.isAdminOrGlobalMod || !!results.moderatedCids.length))) {
return next(new Error('[[error:invalid-data]]')); return next(); // 404
} else if (!(results.isAdminOrGlobalMod || !!results.moderatedCids.length)) {
return next(new Error('[[error:no-privileges]]'));
} }
if (results.flagData.type === 'user') { if (results.flagData.type === 'user') {