Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2026-03-03 11:01:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: gate crossposting behind new topics:crosspost privilege

Browse Source
This commit is contained in:
Julian Lam
2026-02-12 15:13:55 -05:00
parent 5c35dc866c
commit fe8fd9d6e5
2 changed files with 18 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/topics/crossposts.js
View File

@@ -6,6 +6,7 @@ const topics = require('.');
const user = require('../user'); const user = require('../user');
const categories = require('../categories'); const categories = require('../categories');
const posts = require('../posts'); const posts = require('../posts');
const privileges = require('../privileges');
const activitypub = require('../activitypub'); const activitypub = require('../activitypub');
const utils = require('../utils'); const utils = require('../utils');
@@ -56,10 +57,16 @@ Crossposts.add = async function (tid, cid, uid) {
if (!utils.isNumber(cid)) { if (!utils.isNumber(cid)) {
await activitypub.actors.assert(cid); await activitypub.actors.assert(cid);
} }
const exists = await categories.exists(cid); const [exists, allowed] = await Promise.all([
categories.exists(cid),
uid === 0 || privileges.categories.can('topics:crosspost', cid, uid),
]);
if (!exists) { if (!exists) {
throw new Error('[[error:invalid-cid]]'); throw new Error('[[error:invalid-cid]]');
} }
if (!allowed) {
throw new Error('[[error:not-allowed]]');
}
if (uid < 0) { if (uid < 0) {
throw new Error('[[error:invalid-uid]]'); throw new Error('[[error:invalid-uid]]');
} }

11
test/topics/crossposts.js
View File

@@ -87,10 +87,19 @@ describe('Crossposting (& related logic)', () => {
it('should not allow a spider (uid -1) to crosspost', async () => { it('should not allow a spider (uid -1) to crosspost', async () => {
await assert.rejects( await assert.rejects(
topics.crossposts.add(tid, cid2, -1), topics.crossposts.add(tid, cid2, -1),
{ message: '[[error:invalid-uid]]' } { message: '[[error:not-allowed]]' }
); );
}); });
it('should not allow a crosspost if privilege is missing', async () => {
await privileges.categories.rescind(['groups:topics:crosspost'], cid2, 'registered-users');
await assert.rejects(
topics.crossposts.add(tid, cid2, uid),
{ message: '[[error:not-allowed]]' }
);
await privileges.categories.give(['groups:topics:crosspost'], cid2, 'registered-users');
});
it('should successfully crosspost to another cid', async () => { it('should successfully crosspost to another cid', async () => {
const crossposts = await topics.crossposts.add(tid, cid2, uid); const crossposts = await topics.crossposts.add(tid, cid2, uid);