diff options
Diffstat (limited to 'bucky/app')
| -rw-r--r-- | bucky/app/bucky.js | 13 | ||||
| -rw-r--r-- | bucky/app/router.js | 1 |
2 files changed, 13 insertions, 1 deletions
diff --git a/bucky/app/bucky.js b/bucky/app/bucky.js index 1b14f43..ec0ab8c 100644 --- a/bucky/app/bucky.js +++ b/bucky/app/bucky.js @@ -448,6 +448,12 @@ var bucky = module.exports = { /* PRIVACY */ + checkIsAdmin: function(req, res, next){ + if (req.user.get('ulevel') !== 3) { + return res.sendStatus(500) + } + next() + }, checkUserPrivacy: function(req, res, next) { if (req.user.get('username') !== res.user.get('username')) { return res.sendStatus(500) @@ -455,7 +461,7 @@ var bucky = module.exports = { next() }, checkThreadPrivacy: function(req, res, next) { - if (req.user.get('ulevel') !== 3 && req.user.get('username') !== res.thread.get('username')) { + if (res.thread.checkPrivacy(req.user)) { return res.sendStatus(500) } next() @@ -473,6 +479,11 @@ var bucky = module.exports = { } next() }, + checkThreadsPrivacy: function(req, res, next) { + res.threads = res.threads.filter(thread => { + return thread.checkPrivacy(req.user) + }) + }, /* MAIL */ diff --git a/bucky/app/router.js b/bucky/app/router.js index cb90350..106c65e 100644 --- a/bucky/app/router.js +++ b/bucky/app/router.js @@ -142,6 +142,7 @@ module.exports = function(app){ middleware.ensureAuthenticated, bucky.ensureThread, bucky.bumpViewCount, + bucky.ensureThreadPrivacy, bucky.ensureKeywordForThread, bucky.ensureCommentsForThread, bucky.ensureFilesForThread, |