Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2026-02-13 18:17:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: gate crossposting behind new topics:crosspost privilege

Browse Source
This commit is contained in:
Julian Lam
2026-02-12 15:13:55 -05:00
parent 5c35dc866c
commit fe8fd9d6e5
2 changed files with 18 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/topics/crossposts.js
View File

@@ -6,6 +6,7 @@ const topics = require('.');
const user = require('../user');
const categories = require('../categories');
const posts = require('../posts');
const privileges = require('../privileges');
const activitypub = require('../activitypub');
const utils = require('../utils');
@@ -56,10 +57,16 @@ Crossposts.add = async function (tid, cid, uid) {
if (!utils.isNumber(cid)) {
await activitypub.actors.assert(cid);
}
const exists = await categories.exists(cid);
const [exists, allowed] = await Promise.all([
categories.exists(cid),
uid === 0 || privileges.categories.can('topics:crosspost', cid, uid),
]);
if (!exists) {
throw new Error('[[error:invalid-cid]]');
}
if (!allowed) {
throw new Error('[[error:not-allowed]]');
}
if (uid < 0) {
throw new Error('[[error:invalid-uid]]');
}

11
test/topics/crossposts.js
View File

@@ -87,10 +87,19 @@ describe('Crossposting (& related logic)', () => {
it('should not allow a spider (uid -1) to crosspost', async () => {
await assert.rejects(
topics.crossposts.add(tid, cid2, -1),
{ message: '[[error:invalid-uid]]' }
{ message: '[[error:not-allowed]]' }
);
});
it('should not allow a crosspost if privilege is missing', async () => {
await privileges.categories.rescind(['groups:topics:crosspost'], cid2, 'registered-users');
await assert.rejects(
topics.crossposts.add(tid, cid2, uid),
{ message: '[[error:not-allowed]]' }
);
await privileges.categories.give(['groups:topics:crosspost'], cid2, 'registered-users');
});
it('should successfully crosspost to another cid', async () => {
const crossposts = await topics.crossposts.add(tid, cid2, uid);