From 7f77517fc80f43253a33055b64d30e6d7b751dfd Mon Sep 17 00:00:00 2001 From: syuilo Date: Wed, 19 Dec 2018 00:57:28 +0900 Subject: [Client] Resolve #3658 --- src/server/api/endpoints/drive/files/update.ts | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'src/server/api/endpoints/drive') diff --git a/src/server/api/endpoints/drive/files/update.ts b/src/server/api/endpoints/drive/files/update.ts index 7f9eb7bad3..a17ff2bf34 100644 --- a/src/server/api/endpoints/drive/files/update.ts +++ b/src/server/api/endpoints/drive/files/update.ts @@ -57,14 +57,17 @@ export default define(meta, (ps, user) => new Promise(async (res, rej) => { // Fetch file const file = await DriveFile .findOne({ - _id: ps.fileId, - 'metadata.userId': user._id + _id: ps.fileId }); if (file === null) { return rej('file-not-found'); } + if (!user.isAdmin && !user.isModerator && !file.metadata.userId.equals(user._id)) { + return rej('access denied'); + } + if (ps.name) file.filename = ps.name; if (ps.isSensitive !== undefined) file.metadata.isSensitive = ps.isSensitive; -- cgit v1.2.3-freya