hyperzlib
/
nodebb
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: check privileges before exporting post/topic data

Browse Source
v1.18.x
Barış Soner Uşaklı 5 years ago
parent f0323b6cfa
commit 5fd81c5c04
1 changed files with 12 additions and 8 deletions
Show Stats Download Patch File Download Diff File

20
src/controllers/user.js
Unescape Escape View File

@ -195,11 +195,11 @@ userController.exportProfile = async function (req, res) {
user.auth.getSessions(targetUid, req.sessionID), user.auth.getSessions(targetUid, req.sessionID),
user.getHistory('user:' + targetUid + ':usernames'), user.getHistory('user:' + targetUid + ':usernames'),
user.getHistory('user:' + targetUid + ':emails'), user.getHistory('user:' + targetUid + ':emails'),
getSetData('uid:' + targetUid + ':bookmarks', 'post:'), getSetData('uid:' + targetUid + ':bookmarks', 'post:', targetUid),
getSetData('uid:' + targetUid + ':followed_tids', 'topic:'), getSetData('uid:' + targetUid + ':followed_tids', 'topic:', targetUid),
getSetData('uid:' + targetUid + ':upvote', 'post:'), getSetData('uid:' + targetUid + ':upvote', 'post:', targetUid),
getSetData('uid:' + targetUid + ':downvote', 'post:'), getSetData('uid:' + targetUid + ':downvote', 'post:', targetUid),
getSetData('following:' + targetUid, 'user:'), getSetData('following:' + targetUid, 'user:', targetUid),
]); ]);
delete userData.password; delete userData.password;
const followingData = following.map(u => ({ username: u.username, uid: u.uid })); const followingData = following.map(u => ({ username: u.username, uid: u.uid }));
@ -239,15 +239,19 @@ async function getRoomMessages(uid, roomId) {
return data; return data;
} }
async function getSetData(set, keyPrefix) { async function getSetData(set, keyPrefix, uid) {
let data = []; let data = [];
await batch.processSortedSet(set, async (ids) => { await batch.processSortedSet(set, async (ids) => {
data = data.concat(await db.getObjects(ids.map(mid => keyPrefix + mid))); if (keyPrefix === 'post:') {
ids = await privileges.posts.filter('topics:read', ids, uid);
} else if (keyPrefix === 'topic:') {
ids = await privileges.topics.filterTids('topics:read', ids, uid);
}
data = data.concat(await db.getObjects(ids.map(id => keyPrefix + id)));
}, { batch: 500 }); }, { batch: 500 });
return data; return data;
} }
require('../promisify')(userController, [ require('../promisify')(userController, [
'getCurrentUser', 'getUserByUID', 'getUserByUsername', 'getUserByEmail', 'getCurrentUser', 'getUserByUID', 'getUserByUsername', 'getUserByEmail',
'exportPosts', 'exportUploads', 'exportProfile', 'exportPosts', 'exportUploads', 'exportProfile',

Write Preview
Loading…
Cancel
Save