Nemcio/meanTorrent
1
0
Fork 0
mirror of https://github.com/taobataoma/meanTorrent.git synced 2026-02-28 09:10:59 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix(forums): update/delete access check

Browse Source
This commit is contained in:
OldHawk
2017-07-16 16:03:55 +08:00
parent b1053cd653
commit 90f63e8eb9
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
modules/forums/server/controllers/forums.server.controller.js
View File

@@ -369,7 +369,7 @@ exports.toggleTopicTopStatus = function (req, res) {
exports.toggleTopicGlobalStatus = function (req, res) {
var topic = req.topic;
if (!req.user.isOper) {
if (!req.user.toJSON().isOper && !req.user.toJSON().isAdmin) {
return res.status(403).json({
message: 'ERROR: User is not authorized'
});
@@ -850,7 +850,9 @@ exports.topicById = function (req, res, next, id) {
* @returns {boolean}
*/
function canEdit(u, f) {
if (u.isOper) {
if (u.toJSON().isOper) {
return true;
} else if (u.toJSON().isAdmin) {
return true;
} else if (isModerator(f)) {
return true;
@@ -862,7 +864,7 @@ function canEdit(u, f) {
if (f) {
var isM = false;
f.moderators.forEach(function (m) {
if (m._id === u._id) {
if (m._id.equals(u._id)) {
isM = true;
}
});
@@ -880,7 +882,7 @@ function canEdit(u, f) {
*/
function isOwner(u, o) {
if (o) {
if (o.user._id.str === u._id) {
if (o.user._id.equals(u._id)) {
return true;
} else {
return false;