ambiser
/
umami
9
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update permissions.

pull/1745/head
Brian Cao 2023-01-16 13:47:19 -08:00
parent f1db3d0451
commit dd2d9dc3f5
4 changed files with 5 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
lib/auth.js
View File

@ -35,7 +35,7 @@ export function isValidToken(token, validation) {
return false; return false;
} }
export async function allowQuery(req, type) { export async function allowQuery(req, type, allowShareToken = true) {
const { id } = req.query; const { id } = req.query;
const { userId, isAdmin, shareToken } = req.auth ?? {}; const { userId, isAdmin, shareToken } = req.auth ?? {};
@ -44,7 +44,7 @@ export async function allowQuery(req, type) {
return true; return true;
} }
if (shareToken) { if (allowShareToken && shareToken) {
return isValidToken(shareToken, { id }); return isValidToken(shareToken, { id });
} }

2
pages/api/accounts/[id]/password.js
View File

@ -17,7 +17,7 @@ export default async (req, res) => {
const { current_password, new_password } = req.body; const { current_password, new_password } = req.body;
const { id: accountUuid } = req.query; const { id: accountUuid } = req.query;
if (!(await allowQuery(req, TYPE_ACCOUNT))) { if (!(await allowQuery(req, TYPE_ACCOUNT, false))) {
return unauthorized(res); return unauthorized(res);
} }

3
pages/api/websites/[id]/index.js
View File

@ -9,9 +9,8 @@ export default async (req, res) => {
await useAuth(req, res); await useAuth(req, res);
const { id: websiteUuid } = req.query; const { id: websiteUuid } = req.query;
const { userId } = req.auth;
if (!userId || !(await allowQuery(req, TYPE_WEBSITE))) { if (!(await allowQuery(req, TYPE_WEBSITE, false))) {
return unauthorized(res); return unauthorized(res);
} }

2
pages/api/websites/[id]/reset.js
View File

@ -11,7 +11,7 @@ export default async (req, res) => {
const { id: websiteId } = req.query; const { id: websiteId } = req.query;
if (req.method === 'POST') { if (req.method === 'POST') {
if (!(await allowQuery(req, TYPE_WEBSITE))) { if (!(await allowQuery(req, TYPE_WEBSITE, false))) {
return unauthorized(res); return unauthorized(res);
} }