diff options
Diffstat (limited to 'src/server/api/endpoints/drive/files')
| -rw-r--r-- | src/server/api/endpoints/drive/files/update.ts | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/src/server/api/endpoints/drive/files/update.ts b/src/server/api/endpoints/drive/files/update.ts index 7f9eb7bad3..a17ff2bf34 100644 --- a/src/server/api/endpoints/drive/files/update.ts +++ b/src/server/api/endpoints/drive/files/update.ts @@ -57,14 +57,17 @@ export default define(meta, (ps, user) => new Promise(async (res, rej) => { // Fetch file const file = await DriveFile .findOne({ - _id: ps.fileId, - 'metadata.userId': user._id + _id: ps.fileId }); if (file === null) { return rej('file-not-found'); } + if (!user.isAdmin && !user.isModerator && !file.metadata.userId.equals(user._id)) { + return rej('access denied'); + } + if (ps.name) file.filename = ps.name; if (ps.isSensitive !== undefined) file.metadata.isSensitive = ps.isSensitive; |