Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2026-03-03 11:01:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: remove allowed check from notes.assert as it is already done downstream in topics.(post|reply), update privilege check to inherit world privs if passed-in cid is remote cid

Browse Source
This commit is contained in:
Julian Lam
2026-02-26 22:39:52 -05:00
parent 4a0f44b118
commit 6472462924
2 changed files with 3 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
src/activitypub/notes.js
View File

@@ -199,10 +199,7 @@ Notes.assert = async (uid, input, options = { skipChecks: false }) => {
uid || hasTid ||
options.skipChecks || options.cid ||
await assertRelation(chain[inputIndex !== -1 ? inputIndex : 0]);
const privilege = `topics:${tid ? 'reply' : 'create'}`;
const allowed = await privileges.categories.can(privilege, options.cid || cid, activitypub._constants.uid);
if (!hasRelation || !allowed) {
if (!hasRelation) {
if (!hasRelation) {
activitypub.helpers.log(`[activitypub/notes.assert] Not asserting ${id} as it has no relation to existing tracked content.`);
}

4
src/topics/create.js
View File

@@ -98,8 +98,8 @@ module.exports = function (Topics) {
const [categoryExists, canCreate, canTag, isAdmin] = await Promise.all([
parseInt(data.cid, 10) > 0 ? categories.exists(data.cid) : true,
privileges.categories.can('topics:create', data.cid, remoteUid ? -2 : uid),
privileges.categories.can('topics:tag', data.cid, remoteUid ? -2 : uid),
privileges.categories.can('topics:create', utils.isNumber(data.cid) ? data.cid : -1, remoteUid ? -2 : uid),
privileges.categories.can('topics:tag', utils.isNumber(data.cid) ? data.cid : -1, remoteUid ? -2 : uid),
privileges.users.isAdministrator(uid),
]);