diff options
Diffstat (limited to 'src/server/api')
| -rw-r--r-- | src/server/api/endpoints/notes/delete.ts | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/src/server/api/endpoints/notes/delete.ts b/src/server/api/endpoints/notes/delete.ts index 6d9826cf7b..741a8a1dc0 100644 --- a/src/server/api/endpoints/notes/delete.ts +++ b/src/server/api/endpoints/notes/delete.ts @@ -21,14 +21,17 @@ export default (params: any, user: ILocalUser) => new Promise(async (res, rej) = // Fetch note const note = await Note.findOne({ - _id: noteId, - userId: user._id + _id: noteId }); if (note === null) { return rej('note not found'); } + if (!user.isAdmin && !note.userId.equals(user._id)) { + return rej('access denied'); + } + await deleteNote(user, note); res(); |