mirrors/etherpad-lite
1
0
Fork 0
mirror of https://github.com/ether/etherpad-lite.git synced 2025-04-20 15:36:16 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

security: Check authentication in SecurityManager checkAccess

Browse source 
In addition to providing defense in depth, this change makes it easier
to implement future enhancements such as support for read-only users.
This commit is contained in:
Richard Hansen 2020-09-11 17:12:29 -04:00 • committed by John McLear
parent 259b8d891d
commit f9087fabd6
5 changed files with 22 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/node/handler/SocketIORouter.js
View file

@ -97,7 +97,9 @@ exports.setSocketIO = function(_socket) {
padId = await readOnlyManager.getPadId(message.padId);
}
let { accessStatus } = await securityManager.checkAccess(padId, message.sessionID, message.token, message.password);
const {session: {user} = {}} = client.client.request;
const {accessStatus} = await securityManager.checkAccess(
padId, message.sessionID, message.token, message.password, user);
if (accessStatus === "grant") {
// access was granted, mark the client as authorized and handle the message