Fix anonymouse view permission check

This commit is contained in:
蒼時弦也 2017-01-05 23:37:10 +08:00
parent aaf1ff4b2f
commit 1fbecbb03d

View file

@ -117,12 +117,15 @@ function newNote(req, res, next) {
}
function checkViewPermission(req, note) {
if (note.permission == 'private' || !config.allowanonymousView) {
if (note.permission == 'private') {
if (!req.isAuthenticated() || note.ownerId != req.user.id)
return false;
else
return true;
} else {
if(!config.allowanonymousView && !req.isAuthenticated()) {
return false;
}
return true;
}
}