vasyahacker
/
openidec
1
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity

access to web private msgs

pull/1/head
Peter Kosyh 2021-03-11 10:06:14 +03:00
parent 6627d1de8b
commit 58af801c2c
2 changed files with 20 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
ii-node/web.go
View File

@ -496,6 +496,11 @@ func www_topic(ctx *WebContext, w http.ResponseWriter, r *http.Request, page int
if mi == nil {
return errors.New("No such message")
}
if !db.Access(mi, ctx.User) {
return errors.New("Access denied")
}
if page == 0 {
ctx.Selected = id
}

22
ii/db.go
View File

@ -484,6 +484,19 @@ func prependStr(x []string, y string) []string {
return x
}
// Check if message is private
func (db *DB) Access(info *MsgInfo, user *User) bool {
if IsPrivate(info.Echo) {
if user.Name == "" {
return false
}
if info.To != "All" && info.From != user.Name && info.To != user.Name {
return false
}
}
return true
}
// Default match function for queries.
func (db *DB) Match(info *MsgInfo, r Query) bool {
if r.Blacklisted {
@ -509,13 +522,8 @@ func (db *DB) Match(info *MsgInfo, r Query) bool {
if r.From != "" && r.From != info.From {
return false
}
if IsPrivate(info.Echo) {
if r.User.Name == "" {
return false
}
if info.To != "All" && info.From != r.User.Name && info.To != r.User.Name {
return false
}
if !db.Access(info, &r.User) {
return false
}
if r.Match != nil {
return r.Match(info, r)