mirrors/etherpad-lite
1
0
Fork 0
mirror of https://github.com/ether/etherpad-lite.git synced 2025-04-22 08:26:16 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 26

Pad: Plumb author ID through mutation operations

Browse source
This commit is contained in:
Richard Hansen 2022-02-17 00:01:07 -05:00
parent 5f60b3aab2
commit 3b8549342a
7 changed files with 35 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/node/hooks/express/importexport.js
View file

@ -70,12 +70,12 @@ exports.expressCreateServer = (hookName, args, cb) => {
args.app.post('/p/:pad/import', (req, res, next) => {
(async () => {
const {session: {user} = {}} = req;
const {accessStatus} = await securityManager.checkAccess(
const {accessStatus, authorID: authorId} = await securityManager.checkAccess(
req.params.pad, req.cookies.sessionID, req.cookies.token, user);
if (accessStatus !== 'grant' || !webaccess.userCanModify(req.params.pad, req)) {
return res.status(403).send('Forbidden');
}
await importHandler.doImport(req, res, req.params.pad);
await importHandler.doImport(req, res, req.params.pad, authorId);
})().catch((err) => next(err || new Error(err)));
});