sa6anw/hedgedoc-hedgeagent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix locked or private permission should block any operation if owner is null

Browse Source
This commit is contained in:
Cheng-Han, Wu
2016-06-17 16:29:45 +08:00
parent a1198339db
commit 03e68f92eb
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
lib/realtime.js
View File

@@ -540,7 +540,7 @@ function ifMayEdit(socket, callback) {
break;
case "locked": case "private":
//only owner can change
if (note.owner != socket.request.user.id)
if (!note.owner || note.owner != socket.request.user.id)
mayEdit = false;
break;
}
@@ -641,7 +641,7 @@ function connection(socket) {
if (!noteId || !notes[noteId]) return;
var note = notes[noteId];
//Only owner can change permission
if (note.owner == socket.request.user.id) {
if (note.owner && note.owner == socket.request.user.id) {
note.permission = permission;
models.Note.update({
permission: permission