Andreas/wekan
1
0
Fork 0
mirror of https://github.com/wekan/wekan.git synced 2026-01-04 16:48:49 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

More enhancements to Admin Reports and security fixes

Browse source 
* update Boards Report
* use Boards.userBoards() instead of Boards.find() to make sure user has access permission
This commit is contained in:
John Supplee 2021-12-21 02:39:16 +02:00
parent d9c290deda
commit 42610d9642
5 changed files with 107 additions and 84 deletions
Download patch file Download diff file Expand all files Collapse all files

22
models/boards.js
View file

@ -5,6 +5,7 @@ import {
TYPE_TEMPLATE_BOARD,
TYPE_TEMPLATE_CONTAINER,
} from '/config/const';
import Users from "./users";
const escapeForRegex = require('escape-string-regexp');
Boards = new Mongo.Collection('boards');
@ -1485,6 +1486,11 @@ Boards.userBoards = (
selector = {},
projection = {},
) => {
const user = Users.findOne(userId);
if (!user) {
return [];
}
if (typeof archived === 'boolean') {
selector.archived = archived;
}
@ -1492,14 +1498,14 @@ Boards.userBoards = (
selector.type = 'board';
}
selector.$or = [{ permission: 'public' }];
if (userId) {
selector.$or.push(
{ members: { $elemMatch: { userId, isActive: true } } },
projection,
);
}
return Boards.find(selector);
selector.$or = [
{ permission: 'public' },
{ members: { $elemMatch: { userId, isActive: true } } },
{ 'orgs.orgId': { $in: user.orgIds() } },
{ 'teams.teamId': { $in : user.teamIds() } },
];
return Boards.find(selector, projection);
};
Boards.userBoardIds = (userId, archived = false, selector = {}) => {