mirror of
https://github.com/filecoin-project/slate.git
synced 2024-09-11 22:07:08 +03:00
fix(api/slates): verify if the user sending the request is the slate's owner
This commit is contained in:
parent
baebf96481
commit
bd23fec9c4
@ -20,6 +20,10 @@ export default async (req, res) => {
|
||||
return res.status(500).send({ decorator: "SERVER_DELETE_SLATE_SLATE_NOT_FOUND", error: true });
|
||||
}
|
||||
|
||||
if (slate.ownerId !== id) {
|
||||
return res.status(403).send({ decorator: "SERVER_DELETE_SLATE_SLATE_NOT_FOUND", error: true });
|
||||
}
|
||||
|
||||
const deleteResponse = await Data.deleteSlateById({ id: slate.id });
|
||||
|
||||
if (!deleteResponse) {
|
||||
|
@ -36,6 +36,12 @@ export default async (req, res) => {
|
||||
});
|
||||
}
|
||||
|
||||
if (slate.ownerId !== id) {
|
||||
return res
|
||||
.status(403)
|
||||
.send({ decorator: "SERVER_REMOVE_FROM_SLATE_SLATE_NOT_FOUND", error: true });
|
||||
}
|
||||
|
||||
let response = await Data.deleteSlateFiles({ slateId: slate.id, ids: fileIds });
|
||||
|
||||
if (!response || response.error) {
|
||||
|
@ -30,6 +30,10 @@ export default async (req, res) => {
|
||||
return res.status(500).send({ decorator: "SERVER_UPDATE_SLATE_NOT_FOUND", error: true });
|
||||
}
|
||||
|
||||
if (slate.ownerId !== id) {
|
||||
return res.status(403).send({ decorator: "SERVER_UPDATE_SLATE_NOT_FOUND", error: true });
|
||||
}
|
||||
|
||||
if (updates.body && updates.body.length > 2000) {
|
||||
return res.status(400).send({ decorator: "SERVER_UPDATE_SLATE_MAX_BODY_LENGTH", error: true });
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user