liz/wikijs-fork
liz/wikijs-fork
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: check update page access using original page path

Browse Source
This commit is contained in:
NGPixel 2022-02-20 18:46:03 -05:00
parent 3f5388d093
commit 411802ec2f
No known key found for this signature in database
GPG Key ID: 8FDA2F1757F60D63
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
server/models/pages.js
View File

@ -371,8 +371,8 @@ module.exports = class Page extends Model {
// -> Check for page access // -> Check for page access
if (!WIKI.auth.checkAccess(opts.user, ['write:pages'], { if (!WIKI.auth.checkAccess(opts.user, ['write:pages'], {
locale: opts.locale, locale: ogPage.localeCode,
path: opts.path path: ogPage.path
})) { })) {
throw new WIKI.Error.PageUpdateForbidden() throw new WIKI.Error.PageUpdateForbidden()
} }
@ -456,6 +456,14 @@ module.exports = class Page extends Model {
// -> Perform move? // -> Perform move?
if ((opts.locale && opts.locale !== page.localeCode) || (opts.path && opts.path !== page.path)) { if ((opts.locale && opts.locale !== page.localeCode) || (opts.path && opts.path !== page.path)) {
// -> Check target path access
if (!WIKI.auth.checkAccess(opts.user, ['write:pages'], {
locale: opts.locale,
path: opts.path
})) {
throw new WIKI.Error.PageMoveForbidden()
}
await WIKI.models.pages.movePage({ await WIKI.models.pages.movePage({
id: page.id, id: page.id,
destinationLocale: opts.locale, destinationLocale: opts.locale,