Browse Source
fix: check update page access using original page path
pull/5044/head
NGPixel
2 years ago
No known key found for this signature in database
GPG Key ID: 8FDA2F1757F60D63
1 changed files with
10 additions and
2 deletions
-
server/models/pages.js
|
|
|
@ -371,8 +371,8 @@ module.exports = class Page extends Model { |
|
|
|
|
|
|
|
// -> Check for page access
|
|
|
|
if (!WIKI.auth.checkAccess(opts.user, ['write:pages'], { |
|
|
|
locale: opts.locale, |
|
|
|
path: opts.path |
|
|
|
locale: ogPage.localeCode, |
|
|
|
path: ogPage.path |
|
|
|
})) { |
|
|
|
throw new WIKI.Error.PageUpdateForbidden() |
|
|
|
} |
|
|
|
@ -456,6 +456,14 @@ module.exports = class Page extends Model { |
|
|
|
|
|
|
|
// -> Perform move?
|
|
|
|
if ((opts.locale && opts.locale !== page.localeCode) || (opts.path && opts.path !== page.path)) { |
|
|
|
// -> Check target path access
|
|
|
|
if (!WIKI.auth.checkAccess(opts.user, ['write:pages'], { |
|
|
|
locale: opts.locale, |
|
|
|
path: opts.path |
|
|
|
})) { |
|
|
|
throw new WIKI.Error.PageMoveForbidden() |
|
|
|
} |
|
|
|
|
|
|
|
await WIKI.models.pages.movePage({ |
|
|
|
id: page.id, |
|
|
|
destinationLocale: opts.locale, |
|
|
|
|
