Max/zkldi_Tachi
1
0
Fork 0
mirror of https://github.com/zkldi/Tachi.git synced 2026-10-12 01:08:29 +03:00
Code Issues Packages Projects Releases Wiki Activity

emerg: "admins can do whatever" refers to the requesting user, not the user we're applying changes onto

Browse Source 
luckily this was never deployed, but this was *awful*.
This commit is contained in:
zkldi
2022-12-14 03:42:27 +00:00
parent f008570617
commit a35c7f4db4
1 changed files with 22 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/src/server/router/api/v1/users/_userID/middleware.ts
+22 -7
View File
@@ -2,8 +2,11 @@ import { SYMBOL_TACHI_API_AUTH } from "lib/constants/tachi";
import { UserAuthLevels } from "tachi-common";
import { IsNullish } from "utils/misc";
import { AssignToReqTachiData, GetTachiData } from "utils/req-tachi-data";
import { ResolveUser } from "utils/user";
import { GetUserWithID, ResolveUser } from "utils/user";
import type { RequestHandler } from "express";
import CreateLogCtx from "lib/logger/logger";
const logger = CreateLogCtx(__filename);
export const GetUserFromParam: RequestHandler = async (req, res, next) => {
if (!req.params.userID) {
@@ -52,14 +55,9 @@ export const GetUserFromParam: RequestHandler = async (req, res, next) => {
/**
* Require the user making this request to also be the user in the :userID param.
*/
export const RequireAuthedAsUser: RequestHandler = (req, res, next) => {
export const RequireAuthedAsUser: RequestHandler = async (req, res, next) => {
const user = GetTachiData(req, "requestedUser");
// admins can do whatever.
if (user.authLevel === UserAuthLevels.ADMIN) {
next();
return;
}
if (req[SYMBOL_TACHI_API_AUTH].userID === null) {
return res.status(401).json({
@@ -68,6 +66,23 @@ export const RequireAuthedAsUser: RequestHandler = (req, res, next) => {
});
}
const requestingUser = await GetUserWithID(req[SYMBOL_TACHI_API_AUTH].userID);
if (!requestingUser) {
logger.severe(`${req[SYMBOL_TACHI_API_AUTH].userID} is signed in as someone who does not exist.`);
return res.status(500).json({
success: false,
description: `You are signed in as someone who does not exist.`
});
}
// admins can do whatever.
if (requestingUser.authLevel === UserAuthLevels.ADMIN) {
next();
return;
}
if (req[SYMBOL_TACHI_API_AUTH].userID !== user.id) {
return res.status(403).json({
success: false,