jjkiers/cloudron-box
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Allow user details only for the same user or admins

Browse Source
This commit is contained in:
Johannes Zellner
2016-02-25 13:44:53 +01:00
parent b5b0ab7475
commit 4f7fd9177c
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/routes/user.js
View File

@@ -136,6 +136,8 @@ function listUser(req, res, next) {
function info(req, res, next) {
assert.strictEqual(typeof req.params.userId, 'string');
if (req.user.id !== req.params.userId && !req.user.admin) return next(new HttpError(403, 'Not allowed'));
user.get(req.params.userId, function (error, result) {
if (error && error.reason === UserError.NOT_FOUND) return next(new HttpError(404, 'No such user'));
if (error) return next(new HttpError(500, error));