diff options
| author | syuilo <syuilotan@yahoo.co.jp> | 2018-12-15 00:09:04 +0900 |
|---|---|---|
| committer | syuilo <syuilotan@yahoo.co.jp> | 2018-12-15 00:09:04 +0900 |
| commit | ebceffba1eb3d762fe164a10ee58fc78547a0a27 (patch) | |
| tree | 8000bbb47469f637578ad59677a6d19b037fb846 /src/server/api/endpoints/drive | |
| parent | :art: (diff) | |
| download | sharkey-ebceffba1eb3d762fe164a10ee58fc78547a0a27.tar.gz sharkey-ebceffba1eb3d762fe164a10ee58fc78547a0a27.tar.bz2 sharkey-ebceffba1eb3d762fe164a10ee58fc78547a0a27.zip | |
Resolve #2165
Diffstat (limited to 'src/server/api/endpoints/drive')
| -rw-r--r-- | src/server/api/endpoints/drive/files/delete.ts | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/src/server/api/endpoints/drive/files/delete.ts b/src/server/api/endpoints/drive/files/delete.ts index 7367c8fbb6..0c2799c708 100644 --- a/src/server/api/endpoints/drive/files/delete.ts +++ b/src/server/api/endpoints/drive/files/delete.ts @@ -32,14 +32,17 @@ export default define(meta, (ps, user) => new Promise(async (res, rej) => { // Fetch file const file = await DriveFile .findOne({ - _id: ps.fileId, - 'metadata.userId': user._id + _id: ps.fileId }); if (file === null) { return rej('file-not-found'); } + if (!user.isAdmin && !user.isModerator && !file.metadata.userId.equals(user._id)) { + return rej('access denied'); + } + // Delete await del(file); |