shpaq/sct-overseerr
1
0
Fork 0
mirror of https://github.com/sct/overseerr.git synced 2025-09-17 17:24:35 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(issues): only allow edit of own comments & do not allow non-admin delete of issues with comments (#2248)

Browse Source
This commit is contained in:
TheCatLady
2021-10-30 19:54:01 -04:00
committed by GitHub
parent 0828b008ba
commit bba09d69c1
5 changed files with 63 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
server/routes/issue.ts
View File

@@ -302,7 +302,7 @@ issueRoutes.delete('/:issueId', async (req, res, next) => {
if (
!req.user?.hasPermission(Permission.MANAGE_ISSUES) &&
issue.createdBy.id !== req.user?.id
(issue.createdBy.id !== req.user?.id || issue.comments.length > 1)
) {
return next({
status: 401,

7
server/routes/issueComment.ts
View File

@@ -68,13 +68,10 @@ issueCommentRoutes.put<
where: { id: Number(req.params.commentId) },
});
if (
!req.user?.hasPermission([Permission.MANAGE_ISSUES], { type: 'or' }) &&
comment.user.id !== req.user?.id
) {
if (comment.user.id !== req.user?.id) {
return next({
status: 403,
message: 'You do not have permission to edit this comment.',
message: 'You can only edit your own comments.',
});
}