filecoin-project/slate
1
1
Fork 0
mirror of https://github.com/filecoin-project/slate.git synced 2024-09-11 22:07:08 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(api/slates): verify if the user sending the request is the slate's owner

Browse Source
This commit is contained in:
Aminejv 2021-10-13 17:02:12 +01:00
parent baebf96481
commit bd23fec9c4
3 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
pages/api/slates/delete.js
View File

@ -20,6 +20,10 @@ export default async (req, res) => {
return res.status(500).send({ decorator: "SERVER_DELETE_SLATE_SLATE_NOT_FOUND", error: true });
}
if (slate.ownerId !== id) {
return res.status(403).send({ decorator: "SERVER_DELETE_SLATE_SLATE_NOT_FOUND", error: true });
}
const deleteResponse = await Data.deleteSlateById({ id: slate.id });
if (!deleteResponse) {

6
pages/api/slates/remove-file.js
View File

@ -36,6 +36,12 @@ export default async (req, res) => {
});
}
if (slate.ownerId !== id) {
return res
.status(403)
.send({ decorator: "SERVER_REMOVE_FROM_SLATE_SLATE_NOT_FOUND", error: true });
}
let response = await Data.deleteSlateFiles({ slateId: slate.id, ids: fileIds });
if (!response || response.error) {

4
pages/api/slates/update.js
View File

@ -30,6 +30,10 @@ export default async (req, res) => {
return res.status(500).send({ decorator: "SERVER_UPDATE_SLATE_NOT_FOUND", error: true });
}
if (slate.ownerId !== id) {
return res.status(403).send({ decorator: "SERVER_UPDATE_SLATE_NOT_FOUND", error: true });
}
if (updates.body && updates.body.length > 2000) {
return res.status(400).send({ decorator: "SERVER_UPDATE_SLATE_MAX_BODY_LENGTH", error: true });
}