Andreas/wekan
1
0
Fork 0
mirror of https://github.com/wekan/wekan.git synced 2026-02-15 12:38:06 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Security Fix 5: Read-only roles can still update cards.

Browse source 
Thanks to Joshua Rogers of joshua.hu, Twitter MegaManSec !
This commit is contained in:
Lauri Ojansivu 2025-12-29 16:47:11 +02:00
parent 198509e760
commit 181f837d8c
6 changed files with 23 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

6
models/lists.js
View file

@ -685,7 +685,7 @@ if (Meteor.isServer) {
JsonRoutes.add('POST', '/api/boards/:boardId/lists', function(req, res) {
try {
const paramBoardId = req.params.boardId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
Authentication.checkBoardWriteAccess(req.userId, paramBoardId);
const board = ReactiveCache.getBoard(paramBoardId);
const id = Lists.insert({
title: req.body.title,
@ -731,7 +731,7 @@ if (Meteor.isServer) {
const paramBoardId = req.params.boardId;
const paramListId = req.params.listId;
let updated = false;
Authentication.checkBoardAccess(req.userId, paramBoardId);
Authentication.checkBoardWriteAccess(req.userId, paramBoardId);
const list = ReactiveCache.getList({
_id: paramListId,
@ -871,7 +871,7 @@ if (Meteor.isServer) {
try {
const paramBoardId = req.params.boardId;
const paramListId = req.params.listId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
Authentication.checkBoardWriteAccess(req.userId, paramBoardId);
Lists.remove({ _id: paramListId, boardId: paramBoardId });
JsonRoutes.sendResult(res, {
code: 200,