|
|
@ -3,37 +3,12 @@ const router = express.Router() |
|
|
|
const pageHelper = require('../helpers/page') |
|
|
|
const _ = require('lodash') |
|
|
|
const CleanCSS = require('clean-css') |
|
|
|
const moment = require('moment') |
|
|
|
|
|
|
|
/* global WIKI */ |
|
|
|
|
|
|
|
const tmplCreateRegex = /^[0-9]+(,[0-9]+)?$/ |
|
|
|
|
|
|
|
const getPageEffectivePermissions = (req, page) => { |
|
|
|
return { |
|
|
|
comments: { |
|
|
|
read: WIKI.config.features.featurePageComments ? WIKI.auth.checkAccess(req.user, ['read:comments'], page) : false, |
|
|
|
write: WIKI.config.features.featurePageComments ? WIKI.auth.checkAccess(req.user, ['write:comments'], page) : false, |
|
|
|
manage: WIKI.config.features.featurePageComments ? WIKI.auth.checkAccess(req.user, ['manage:comments'], page) : false |
|
|
|
}, |
|
|
|
history: { |
|
|
|
read: WIKI.auth.checkAccess(req.user, ['read:history'], page) |
|
|
|
}, |
|
|
|
source: { |
|
|
|
read: WIKI.auth.checkAccess(req.user, ['read:source'], page) |
|
|
|
}, |
|
|
|
pages: { |
|
|
|
write: WIKI.auth.checkAccess(req.user, ['write:pages'], page), |
|
|
|
manage: WIKI.auth.checkAccess(req.user, ['manage:pages'], page), |
|
|
|
delete: WIKI.auth.checkAccess(req.user, ['delete:pages'], page), |
|
|
|
script: WIKI.auth.checkAccess(req.user, ['write:scripts'], page), |
|
|
|
style: WIKI.auth.checkAccess(req.user, ['write:styles'], page) |
|
|
|
}, |
|
|
|
system: { |
|
|
|
manage: WIKI.auth.checkAccess(req.user, ['manage:system'], page) |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
/** |
|
|
|
* Robots.txt |
|
|
|
*/ |
|
|
@ -137,6 +112,9 @@ router.get(['/e', '/e/*'], async (req, res, next) => { |
|
|
|
|
|
|
|
pageArgs.tags = _.get(page, 'tags', []) |
|
|
|
|
|
|
|
// -> Effective Permissions
|
|
|
|
const effectivePermissions = WIKI.auth.getEffectivePermissions(req, pageArgs) |
|
|
|
|
|
|
|
const injectCode = { |
|
|
|
css: WIKI.config.theming.injectCSS, |
|
|
|
head: WIKI.config.theming.injectHead, |
|
|
@ -145,7 +123,7 @@ router.get(['/e', '/e/*'], async (req, res, next) => { |
|
|
|
|
|
|
|
if (page) { |
|
|
|
// -> EDIT MODE
|
|
|
|
if (!WIKI.auth.checkAccess(req.user, ['write:pages', 'manage:pages'], pageArgs)) { |
|
|
|
if (!(effectivePermissions.pages.write || effectivePermissions.pages.manage)) { |
|
|
|
_.set(res.locals, 'pageMeta.title', 'Unauthorized') |
|
|
|
return res.render('unauthorized', { action: 'edit' }) |
|
|
|
} |
|
|
@ -166,7 +144,7 @@ router.get(['/e', '/e/*'], async (req, res, next) => { |
|
|
|
page.content = Buffer.from(page.content).toString('base64') |
|
|
|
} else { |
|
|
|
// -> CREATE MODE
|
|
|
|
if (!WIKI.auth.checkAccess(req.user, ['write:pages'], pageArgs)) { |
|
|
|
if (!effectivePermissions.pages.write) { |
|
|
|
_.set(res.locals, 'pageMeta.title', 'Unauthorized') |
|
|
|
return res.render('unauthorized', { action: 'create' }) |
|
|
|
} |
|
|
@ -229,9 +207,6 @@ router.get(['/e', '/e/*'], async (req, res, next) => { |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
// -> Effective Permissions
|
|
|
|
const effectivePermissions = getPageEffectivePermissions(req, pageArgs) |
|
|
|
|
|
|
|
res.render('editor', { page, injectCode, effectivePermissions }) |
|
|
|
}) |
|
|
|
|
|
|
@ -262,7 +237,9 @@ router.get(['/h', '/h/*'], async (req, res, next) => { |
|
|
|
|
|
|
|
pageArgs.tags = _.get(page, 'tags', []) |
|
|
|
|
|
|
|
if (!WIKI.auth.checkAccess(req.user, ['read:history'], pageArgs)) { |
|
|
|
const effectivePermissions = WIKI.auth.getEffectivePermissions(req, pageArgs) |
|
|
|
|
|
|
|
if (!effectivePermissions.history.read) { |
|
|
|
_.set(res.locals, 'pageMeta.title', 'Unauthorized') |
|
|
|
return res.render('unauthorized', { action: 'history' }) |
|
|
|
} |
|
|
@ -271,9 +248,6 @@ router.get(['/h', '/h/*'], async (req, res, next) => { |
|
|
|
_.set(res.locals, 'pageMeta.title', page.title) |
|
|
|
_.set(res.locals, 'pageMeta.description', page.description) |
|
|
|
|
|
|
|
// -> Effective Permissions
|
|
|
|
const effectivePermissions = getPageEffectivePermissions(req, pageArgs) |
|
|
|
|
|
|
|
res.render('history', { page, effectivePermissions }) |
|
|
|
} else { |
|
|
|
res.redirect(`/${pageArgs.path}`) |
|
|
@ -346,16 +320,19 @@ router.get(['/s', '/s/*'], async (req, res, next) => { |
|
|
|
return res.redirect(`/s/${pageArgs.locale}/${pageArgs.path}`) |
|
|
|
} |
|
|
|
|
|
|
|
// -> Effective Permissions
|
|
|
|
const effectivePermissions = WIKI.auth.getEffectivePermissions(req, pageArgs) |
|
|
|
|
|
|
|
_.set(res, 'locals.siteConfig.lang', pageArgs.locale) |
|
|
|
_.set(res, 'locals.siteConfig.rtl', req.i18n.dir() === 'rtl') |
|
|
|
|
|
|
|
if (versionId > 0) { |
|
|
|
if (!WIKI.auth.checkAccess(req.user, ['read:history'], pageArgs)) { |
|
|
|
if (!effectivePermissions.history.read) { |
|
|
|
_.set(res.locals, 'pageMeta.title', 'Unauthorized') |
|
|
|
return res.render('unauthorized', { action: 'sourceVersion' }) |
|
|
|
} |
|
|
|
} else { |
|
|
|
if (!WIKI.auth.checkAccess(req.user, ['read:source'], pageArgs)) { |
|
|
|
if (!effectivePermissions.source.read) { |
|
|
|
_.set(res.locals, 'pageMeta.title', 'Unauthorized') |
|
|
|
return res.render('unauthorized', { action: 'source' }) |
|
|
|
} |
|
|
@ -376,9 +353,6 @@ router.get(['/s', '/s/*'], async (req, res, next) => { |
|
|
|
_.set(res.locals, 'pageMeta.title', page.title) |
|
|
|
_.set(res.locals, 'pageMeta.description', page.description) |
|
|
|
|
|
|
|
// -> Effective Permissions
|
|
|
|
const effectivePermissions = getPageEffectivePermissions(req, pageArgs) |
|
|
|
|
|
|
|
res.render('source', { page, effectivePermissions }) |
|
|
|
} |
|
|
|
} else { |
|
|
@ -419,8 +393,11 @@ router.get('/*', async (req, res, next) => { |
|
|
|
}) |
|
|
|
pageArgs.tags = _.get(page, 'tags', []) |
|
|
|
|
|
|
|
// -> Effective Permissions
|
|
|
|
const effectivePermissions = WIKI.auth.getEffectivePermissions(req, pageArgs) |
|
|
|
|
|
|
|
// -> Check User Access
|
|
|
|
if (!WIKI.auth.checkAccess(req.user, ['read:pages'], pageArgs)) { |
|
|
|
if (!effectivePermissions.pages.read) { |
|
|
|
if (req.user.id === 2) { |
|
|
|
res.cookie('loginRedirect', req.path, { |
|
|
|
maxAge: 15 * 60 * 1000 |
|
|
@ -442,6 +419,21 @@ router.get('/*', async (req, res, next) => { |
|
|
|
_.set(res.locals, 'pageMeta.title', page.title) |
|
|
|
_.set(res.locals, 'pageMeta.description', page.description) |
|
|
|
|
|
|
|
// -> Check Publishing State
|
|
|
|
let pageIsPublished = page.isPublished |
|
|
|
if (pageIsPublished && !_.isEmpty(page.publishStartDate)) { |
|
|
|
pageIsPublished = moment(page.publishStartDate).isSameOrBefore() |
|
|
|
} |
|
|
|
if (pageIsPublished && !_.isEmpty(page.publishEndDate)) { |
|
|
|
pageIsPublished = moment(page.publishEndDate).isSameOrAfter() |
|
|
|
} |
|
|
|
if (!pageIsPublished && !effectivePermissions.pages.write) { |
|
|
|
_.set(res.locals, 'pageMeta.title', 'Unauthorized') |
|
|
|
return res.status(403).render('unauthorized', { |
|
|
|
action: 'view' |
|
|
|
}) |
|
|
|
} |
|
|
|
|
|
|
|
// -> Build sidebar navigation
|
|
|
|
let sdi = 1 |
|
|
|
const sidebar = (await WIKI.models.navigation.getTree({ cache: true, locale: pageArgs.locale, groups: req.user.groups })).map(n => ({ |
|
|
@ -499,9 +491,6 @@ router.get('/*', async (req, res, next) => { |
|
|
|
}) |
|
|
|
} |
|
|
|
|
|
|
|
// -> Effective Permissions
|
|
|
|
const effectivePermissions = getPageEffectivePermissions(req, pageArgs) |
|
|
|
|
|
|
|
// -> Render view
|
|
|
|
res.render('page', { |
|
|
|
page, |
|
|
@ -516,7 +505,7 @@ router.get('/*', async (req, res, next) => { |
|
|
|
res.render('welcome', { locale: pageArgs.locale }) |
|
|
|
} else { |
|
|
|
_.set(res.locals, 'pageMeta.title', 'Page Not Found') |
|
|
|
if (WIKI.auth.checkAccess(req.user, ['write:pages'], pageArgs)) { |
|
|
|
if (effectivePermissions.pages.write) { |
|
|
|
res.status(404).render('new', { path: pageArgs.path, locale: pageArgs.locale }) |
|
|
|
} else { |
|
|
|
res.status(404).render('notfound', { action: 'view' }) |
|
|
|