depau/HackMD
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Fixed potential bug in realtime startConnection and bugs in note findOrNewNote, response showNote

Browse source
This commit is contained in:
Cheng-Han, Wu 2016-01-20 23:20:50 -06:00
parent 50805f3540
commit 16dcd27b78
3 changed files with 16 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
lib/note.js
View file

@ -148,10 +148,10 @@ function newNote(id, owner, callback) {
});
}
function findOrNewNote(id, permission, callback) {
function findOrNewNote(id, owner, callback) {
findNote(id, function (err, note) {
if (err || !note) {
newNote(id, permission, function (err, note) {
newNote(id, owner, function (err, note) {
if (err) {
logger.error('find or new note failed: ' + err);
callback(err, null);
@ -161,6 +161,10 @@ function findOrNewNote(id, permission, callback) {
});
} else {
if (!note.permission) {
var permission = "freely";
if (owner && owner != "null") {
permission = "editable";
}
note.permission = permission;
note.updated = Date.now();
note.save(function (err) {

7
lib/realtime.js
View file

@ -394,10 +394,13 @@ function startConnection(socket) {
//find or new note
Note.findOrNewNote(notename, owner, function (err, note) {
if (err) {
responseError(res, "404", "Not Found", "oops.");
socket.emit('info', {
code: 404
});
socket.disconnect(true);
clearSocketQueue(connectionSocketQueue, socket);
isConnectionBusy = false;
return;
return logger.error(err);
}
var body = LZString.decompressFromBase64(data.rows[0].content);

10
lib/response.js
View file

@ -175,15 +175,15 @@ function showNote(req, res, next) {
return response.errorNotFound(res);
}
}
Note.findNote(noteId, function (err, note) {
if (err || !note) {
db.readFromDB(noteId, function (err, data) {
if (err) {
return response.errorNotFound(res);
}
db.readFromDB(note.id, function (err, data) {
if (err) {
var notedata = data.rows[0];
Note.findOrNewNote(noteId, notedata.owner, function (err, note) {
if (err || !note) {
return response.errorNotFound(res);
}
var notedata = data.rows[0];
//check view permission
if (note.permission == 'private') {
if (!req.isAuthenticated() || notedata.owner != req.user._id)