Comunic/comunicapiv2
1
0
Fork 0
mirror of https://gitlab.com/comunic/comunicapiv2 synced 2024-11-22 05:19:22 +00:00
Code Issues Projects Releases Wiki Activity

Fix security issue

Browse Source
This commit is contained in:
Pierre HUBERT 2020-06-18 13:16:36 +02:00
parent 096f2da6a4
commit 34f9abbb1c
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/controllers/ConversationsController.ts
View File

@ -181,7 +181,7 @@ export class ConversationsController {
// Check for new conversations // Check for new conversations
if(h.hasPostParameter("newConversations")) { if(h.hasPostParameter("newConversations")) {
for(const convID of h.postNumbersSet("newConversations", 0)) { for(const convID of h.postNumbersSet("newConversations", 0)) {
if(!ConversationsHelper.DoesUsersBelongsTo(h.getUserId(), convID)) if(!await ConversationsHelper.DoesUsersBelongsTo(h.getUserId(), convID))
h.error(401, "You are not allowed to fetch the messages of this conversation ("+convID+")!"); h.error(401, "You are not allowed to fetch the messages of this conversation ("+convID+")!");
list["conversation-" + convID] = (await ConversationsHelper.GetLastMessages(convID, 10)) list["conversation-" + convID] = (await ConversationsHelper.GetLastMessages(convID, 10))
@ -211,7 +211,7 @@ export class ConversationsController {
const lastMessageID = Number.parseInt(element.last_message_id); const lastMessageID = Number.parseInt(element.last_message_id);
// Check user rights // Check user rights
if(!ConversationsHelper.DoesUsersBelongsTo(h.getUserId(), convID)) if(!await ConversationsHelper.DoesUsersBelongsTo(h.getUserId(), convID))
h.error(401, "You are not allowed to fetch the messages of this conversation ("+convID+")!"); h.error(401, "You are not allowed to fetch the messages of this conversation ("+convID+")!");
// Get the messages // Get the messages