Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-10-31 19:15:58 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: #8156 dont allow loading members from hidden groups

Browse Source
This commit is contained in:
Barış Soner Uşaklı
2020-02-10 13:20:10 -05:00
parent 03a02e5d1d
commit f23bc347b1
2 changed files with 17 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/controllers/groups.js
View File

@@ -33,14 +33,16 @@ groupsController.details = async function (req, res, next) {
if (!groupName) { if (!groupName) {
return next(); return next();
} }
const [exists, isHidden] = await Promise.all([ const [exists, isHidden, isAdmin, isGlobalMod] = await Promise.all([
groups.exists(groupName), groups.exists(groupName),
groups.isHidden(groupName), groups.isHidden(groupName),
user.isAdministrator(req.uid),
user.isGlobalModerator(req.uid),
]); ]);
if (!exists) { if (!exists) {
return next(); return next();
} }
if (isHidden) { if (isHidden && !isAdmin && !isGlobalMod) {
const [isMember, isInvited] = await Promise.all([ const [isMember, isInvited] = await Promise.all([
groups.isMember(req.uid, groupName), groups.isMember(req.uid, groupName),
groups.isInvited(req.uid, groupName), groups.isInvited(req.uid, groupName),
@@ -49,15 +51,13 @@ groupsController.details = async function (req, res, next) {
return next(); return next();
} }
} }
const [groupData, posts, isAdmin, isGlobalMod] = await Promise.all([ const [groupData, posts] = await Promise.all([
groups.get(groupName, { groups.get(groupName, {
uid: req.uid, uid: req.uid,
truncateUserList: true, truncateUserList: true,
userListCount: 20, userListCount: 20,
}), }),
groups.getLatestMemberPosts(groupName, 10, req.uid), groups.getLatestMemberPosts(groupName, 10, req.uid),
user.isAdministrator(req.uid),
user.isGlobalModerator(req.uid),
]); ]);
if (!groupData) { if (!groupData) {
return next(); return next();

12
src/socket.io/groups.js
View File

@@ -342,6 +342,18 @@ SocketGroups.loadMoreMembers = async (socket, data) => {
if (!data.groupName || !utils.isNumber(data.after) || parseInt(data.after, 10) < 0) { if (!data.groupName || !utils.isNumber(data.after) || parseInt(data.after, 10) < 0) {
throw new Error('[[error:invalid-data]]'); throw new Error('[[error:invalid-data]]');
} }
const [isHidden, isAdmin, isGlobalMod] = await Promise.all([
groups.isHidden(data.groupName),
user.isAdministrator(socket.uid),
user.isGlobalModerator(socket.uid),
]);
if (isHidden && !isAdmin && !isGlobalMod) {
const isMember = await groups.isMember(socket.uid, data.groupName);
if (!isMember) {
throw new Error('[[error:no-privileges]]');
}
}
data.after = parseInt(data.after, 10); data.after = parseInt(data.after, 10);
const users = await user.getUsersFromSet('group:' + data.groupName + ':members', socket.uid, data.after, data.after + 9); const users = await user.getUsersFromSet('group:' + data.groupName + ':members', socket.uid, data.after, data.after + 9);
return { return {