depau/HackMD
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Fix anonymouse view permission check

Browse source
This commit is contained in:
蒼時弦也 2017-01-05 23:37:10 +08:00
parent aaf1ff4b2f
commit 1fbecbb03d
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
lib/response.js
View file

@ -117,12 +117,15 @@ function newNote(req, res, next) {
}
function checkViewPermission(req, note) {
if (note.permission == 'private' || !config.allowanonymousView) {
if (note.permission == 'private') {
if (!req.isAuthenticated() || note.ownerId != req.user.id)
return false;
else
return true;
} else {
if(!config.allowanonymousView && !req.isAuthenticated()) {
return false;
}
return true;
}
}