diff --git a/src/socket.io/admin.js b/src/socket.io/admin.js index 631914f05d..bec2f0fae9 100644 --- a/src/socket.io/admin.js +++ b/src/socket.io/admin.js @@ -41,8 +41,9 @@ SocketAdmin.before = async function (socket, method) { } // Check admin privileges mapping (if not in mapping, deny access) - const privilege = privileges.admin.socketMap[method]; - if (privilege && await privileges.admin.can(privilege, socket.uid)) { + const privilegeSet = privileges.admin.socketMap[method].split(';'); + const hasPrivilege = (await Promise.all(privilegeSet.map(async privilege => privileges.admin.can(privilege, socket.uid)))).some(Boolean); + if (privilegeSet.length && hasPrivilege) { return; }