liz/wikijs-fork
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: check update page access using original page path

Browse Source
This commit is contained in:
NGPixel
2022-02-20 18:46:03 -05:00
parent 3f5388d093
commit 411802ec2f
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
server/models/pages.js
View File

@@ -371,8 +371,8 @@ module.exports = class Page extends Model {
// -> Check for page access
if (!WIKI.auth.checkAccess(opts.user, ['write:pages'], {
locale: opts.locale,
path: opts.path
locale: ogPage.localeCode,
path: ogPage.path
})) {
throw new WIKI.Error.PageUpdateForbidden()
}
@@ -456,6 +456,14 @@ module.exports = class Page extends Model {
// -> Perform move?
if ((opts.locale && opts.locale !== page.localeCode) || (opts.path && opts.path !== page.path)) {
// -> Check target path access
if (!WIKI.auth.checkAccess(opts.user, ['write:pages'], {
locale: opts.locale,
path: opts.path
})) {
throw new WIKI.Error.PageMoveForbidden()
}
await WIKI.models.pages.movePage({
id: page.id,
destinationLocale: opts.locale,