Andreas/wekan
1
0
Fork 0
mirror of https://github.com/wekan/wekan.git synced 2025-09-22 01:50:48 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

Try to fix User API.

Browse source 
Thanks to xet7 !

Fixes #4039
This commit is contained in:
Lauri Ojansivu 2023-01-13 21:50:39 +02:00
parent c817deef9e
commit 8092f8be28
9 changed files with 82 additions and 85 deletions
Download patch file Download diff file Expand all files Collapse all files

89
api.py
View file

@ -21,32 +21,39 @@ import sys
arguments = len(sys.argv) - 1 arguments = len(sys.argv) - 1
syntax = """=== Wekan API Python CLI: Shows IDs for addcard ===
# AUTHORID is USERID that writes card or custom field.
If *nix: chmod +x api.py => ./api.py users
Syntax:
User API:
python3 api.py user # Current user and list of current user boards
python3 api.py boards USERID # Boards of USERID
python3 api.py swimlanes BOARDID # Swimlanes of BOARDID
python3 api.py lists BOARDID # Lists of BOARDID
python3 api.py list BOARDID LISTID # Info of LISTID
python3 api.py createlist BOARDID LISTTITLE # Create list
python3 api.py addcard AUTHORID BOARDID SWIMLANEID LISTID CARDTITLE CARDDESCRIPTION
python3 api.py editcard BOARDID LISTID CARDID NEWCARDTITLE NEWCARDDESCRIPTION
python3 api.py customfields BOARDID # Custom Fields of BOARDID
python3 api.py customfield BOARDID CUSTOMFIELDID # Info of CUSTOMFIELDID
python3 api.py addcustomfieldtoboard AUTHORID BOARDID NAME TYPE SETTINGS SHOWONCARD AUTOMATICALLYONCARD SHOWLABELONMINICARD SHOWSUMATTOPOFLIST # Add Custom Field to Board
python3 api.py listattachments BOARDID # List attachments
Admin API:
python3 api.py users # All users
python3 api.py boards # All Public Boards
python3 api.py newuser USERNAME EMAIL PASSWORD
"""
if arguments == 0: if arguments == 0:
print("=== Wekan API Python CLI: Shows IDs for addcard ===") print(syntax)
print("AUTHORID is USERID that writes card.") exit
print("If *nix: chmod +x api.py => ./api.py users")
print("Syntax:")
print(" python3 api.py users # All users")
print(" python3 api.py boards # All Public Boards")
print(" python3 api.py boards USERID # Boards of USERID")
print(" python3 api.py board BOARDID # Info of BOARDID")
print(" python3 api.py customfields BOARDID # Custom Fields of BOARDID")
print(" python3 api.py customfield BOARDID CUSTOMFIELDID # Info of CUSTOMFIELDID")
print(" python3 api.py addcustomfieldtoboard AUTHORID BOARDID NAME TYPE SETTINGS SHOWONCARD AUTOMATICALLYONCARD SHOWLABELONMINICARD SHOWSUMATTOPOFLIST # Add Custom Field to Board")
print(" python3 api.py swimlanes BOARDID # Swimlanes of BOARDID")
print(" python3 api.py lists BOARDID # Lists of BOARDID")
print(" python3 api.py list BOARDID LISTID # Info of LISTID")
print(" python3 api.py createlist BOARDID LISTTITLE # Create list")
print(" python3 api.py addcard AUTHORID BOARDID SWIMLANEID LISTID CARDTITLE CARDDESCRIPTION")
print(" python3 api.py editcard BOARDID LISTID CARDID NEWCARDTITLE NEWCARDDESCRIPTION")
print(" python3 api.py listattachments BOARDID # List attachments")
print(" python3 api.py newuser USERNAME EMAIL PASSWORD")
# TODO: # TODO:
# print(" python3 api.py attachmentjson BOARDID ATTACHMENTID # One attachment as JSON base64") # print(" python3 api.py attachmentjson BOARDID ATTACHMENTID # One attachment as JSON base64")
# print(" python3 api.py attachmentbinary BOARDID ATTACHMENTID # One attachment as binary file") # print(" python3 api.py attachmentbinary BOARDID ATTACHMENTID # One attachment as binary file")
# print(" python3 api.py attachmentdownload BOARDID ATTACHMENTID # One attachment as file") # print(" python3 api.py attachmentdownload BOARDID ATTACHMENTID # One attachment as file")
# print(" python3 api.py attachmentsdownload BOARDID # All attachments as files") # print(" python3 api.py attachmentsdownload BOARDID # All attachments as files")
exit
# ------- SETTINGS START ------------- # ------- SETTINGS START -------------
@ -62,33 +69,6 @@ wekanurl = 'http://localhost:4000/'
# ------- SETTINGS END ------------- # ------- SETTINGS END -------------
""" """
EXAMPLE:
python3 api.py
OR:
chmod +x api.py
./api.py
=== Wekan API Python CLI: Shows IDs for addcard ===
AUTHORID is USERID that writes card.
Syntax:
python3 api.py users # All users
python3 api.py boards USERID # Boards of USERID
python3 api.py board BOARDID # Info of BOARDID
python3 api.py customfields BOARDID # Custom Fields of BOARDID
python3 api.py customfield BOARDID CUSTOMFIELDID # Info of CUSTOMFIELDID
python3 api.py addcustomfieldtoboard AUTHORID BOARDID NAME TYPE SETTINGS SHOWONCARD AUTOMATICALLYONCARD SHOWLABELONMINICARD SHOWSUMATTOPOFLIST # Add Custom Field to Board
python3 api.py swimlanes BOARDID # Swimlanes of BOARDID
python3 api.py lists BOARDID # Lists of BOARDID
python3 api.py list BOARDID LISTID # Info of LISTID
python3 api.py createlist BOARDID LISTTITLE # Create list
python3 api.py addcard AUTHORID BOARDID SWIMLANEID LISTID CARDTITLE CARDDESCRIPTION
python3 api.py editcard BOARDID LISTID CARDID NEWCARDTITLE NEWCARDDESCRIPTION
python3 api.py listattachments BOARDID # List attachments
python3 api.py attachmentjson BOARDID ATTACHMENTID # One attachment as JSON base64
python3 api.py attachmentbinary BOARDID ATTACHMENTID # One attachment as binary file
=== ADD CUSTOM FIELD TO BOARD === === ADD CUSTOM FIELD TO BOARD ===
Type: text, number, date, dropdown, checkbox, currency, stringtemplate. Type: text, number, date, dropdown, checkbox, currency, stringtemplate.
@ -145,6 +125,8 @@ wekanloginurl = wekanurl + loginurl
apiboards = 'api/boards/' apiboards = 'api/boards/'
apiattachments = 'api/attachments/' apiattachments = 'api/attachments/'
apiusers = 'api/users' apiusers = 'api/users'
apiuser = 'api/user'
apiallusers = 'api/allusers'
e = 'export' e = 'export'
s = '/' s = '/'
l = 'lists' l = 'lists'
@ -153,10 +135,13 @@ sws = 'swimlanes'
cs = 'cards' cs = 'cards'
cf = 'custom-fields' cf = 'custom-fields'
bs = 'boards' bs = 'boards'
apbs = 'allpublicboards'
atl = 'attachmentslist' atl = 'attachmentslist'
at = 'attachment' at = 'attachment'
ats = 'attachments' ats = 'attachments'
users = wekanurl + apiusers users = wekanurl + apiusers
user = wekanurl + apiuser
allusers = wekanurl + apiallusers
# ------- API URL GENERATION END ----------- # ------- API URL GENERATION END -----------
@ -372,6 +357,16 @@ if arguments == 1:
print(data2) print(data2)
# ------- LIST OF USERS END ----------- # ------- LIST OF USERS END -----------
if sys.argv[1] == 'user':
# ------- LIST OF ALL USERS START -----------
headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey)}
print(user)
print("=== USER ===\n")
body = requests.get(user, headers=headers)
data2 = body.text.replace('}',"}\n")
print(data2)
# ------- LIST OF ALL USERS END -----------
if sys.argv[1] == 'boards': if sys.argv[1] == 'boards':
# ------- LIST OF PUBLIC BOARDS START ----------- # ------- LIST OF PUBLIC BOARDS START -----------

10
models/boards.js
View file

@ -2002,12 +2002,12 @@ if (Meteor.isServer) {
*/ */
JsonRoutes.add('GET', '/api/boards/:boardId', function(req, res) { JsonRoutes.add('GET', '/api/boards/:boardId', function(req, res) {
try { try {
Authentication.checkUserId(req.userId); const paramBoardId = req.params.boardId;
const id = req.params.boardId; Authentication.checkBoardAccess(req.userId, paramBoardId);
JsonRoutes.sendResult(res, { JsonRoutes.sendResult(res, {
code: 200, code: 200,
data: Boards.findOne({ _id: id }), data: Boards.findOne({ _id: paramBoardId }),
}); });
} catch (error) { } catch (error) {
JsonRoutes.sendResult(res, { JsonRoutes.sendResult(res, {
@ -2120,8 +2120,8 @@ if (Meteor.isServer) {
* @return_type string * @return_type string
*/ */
JsonRoutes.add('PUT', '/api/boards/:boardId/labels', function(req, res) { JsonRoutes.add('PUT', '/api/boards/:boardId/labels', function(req, res) {
Authentication.checkUserId(req.userId);
const id = req.params.boardId; const id = req.params.boardId;
Authentication.checkBoardAccess(req.userId, id);
try { try {
if (req.body.hasOwnProperty('label')) { if (req.body.hasOwnProperty('label')) {
const board = Boards.findOne({ _id: id }); const board = Boards.findOne({ _id: id });
@ -2214,8 +2214,8 @@ if (Meteor.isServer) {
* swimlaneId: string}] * swimlaneId: string}]
*/ */
JsonRoutes.add('GET', '/api/boards/:boardId/attachments', function(req, res) { JsonRoutes.add('GET', '/api/boards/:boardId/attachments', function(req, res) {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
JsonRoutes.sendResult(res, { JsonRoutes.sendResult(res, {
code: 200, code: 200,
data: Attachments.files data: Attachments.files

8
models/cardComments.js
View file

@ -235,9 +235,9 @@ if (Meteor.isServer) {
res, res,
) { ) {
try { try {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
const paramCardId = req.params.cardId; const paramCardId = req.params.cardId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
JsonRoutes.sendResult(res, { JsonRoutes.sendResult(res, {
code: 200, code: 200,
data: CardComments.find({ data: CardComments.find({
@ -273,10 +273,10 @@ if (Meteor.isServer) {
'/api/boards/:boardId/cards/:cardId/comments/:commentId', '/api/boards/:boardId/cards/:cardId/comments/:commentId',
function (req, res) { function (req, res) {
try { try {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
const paramCommentId = req.params.commentId; const paramCommentId = req.params.commentId;
const paramCardId = req.params.cardId; const paramCardId = req.params.cardId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
JsonRoutes.sendResult(res, { JsonRoutes.sendResult(res, {
code: 200, code: 200,
data: CardComments.findOne({ data: CardComments.findOne({
@ -309,9 +309,9 @@ if (Meteor.isServer) {
'/api/boards/:boardId/cards/:cardId/comments', '/api/boards/:boardId/cards/:cardId/comments',
function (req, res) { function (req, res) {
try { try {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
const paramCardId = req.params.cardId; const paramCardId = req.params.cardId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
const id = CardComments.direct.insert({ const id = CardComments.direct.insert({
userId: req.body.authorId, userId: req.body.authorId,
text: req.body.comment, text: req.body.comment,
@ -355,10 +355,10 @@ if (Meteor.isServer) {
'/api/boards/:boardId/cards/:cardId/comments/:commentId', '/api/boards/:boardId/cards/:cardId/comments/:commentId',
function (req, res) { function (req, res) {
try { try {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
const paramCommentId = req.params.commentId; const paramCommentId = req.params.commentId;
const paramCardId = req.params.cardId; const paramCardId = req.params.cardId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
CardComments.remove({ CardComments.remove({
_id: paramCommentId, _id: paramCommentId,
cardId: paramCardId, cardId: paramCardId,

12
models/cards.js
View file

@ -3202,9 +3202,9 @@ if (Meteor.isServer) {
'GET', 'GET',
'/api/boards/:boardId/swimlanes/:swimlaneId/cards', '/api/boards/:boardId/swimlanes/:swimlaneId/cards',
function(req, res) { function(req, res) {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
const paramSwimlaneId = req.params.swimlaneId; const paramSwimlaneId = req.params.swimlaneId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
JsonRoutes.sendResult(res, { JsonRoutes.sendResult(res, {
code: 200, code: 200,
data: Cards.find({ data: Cards.find({
@ -3244,9 +3244,9 @@ if (Meteor.isServer) {
req, req,
res, res,
) { ) {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
const paramListId = req.params.listId; const paramListId = req.params.listId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
JsonRoutes.sendResult(res, { JsonRoutes.sendResult(res, {
code: 200, code: 200,
data: Cards.find({ data: Cards.find({
@ -3281,10 +3281,10 @@ if (Meteor.isServer) {
'GET', 'GET',
'/api/boards/:boardId/lists/:listId/cards/:cardId', '/api/boards/:boardId/lists/:listId/cards/:cardId',
function(req, res) { function(req, res) {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
const paramListId = req.params.listId; const paramListId = req.params.listId;
const paramCardId = req.params.cardId; const paramCardId = req.params.cardId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
JsonRoutes.sendResult(res, { JsonRoutes.sendResult(res, {
code: 200, code: 200,
data: Cards.findOne({ data: Cards.findOne({
@ -3497,10 +3497,10 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
'PUT', 'PUT',
'/api/boards/:boardId/lists/:listId/cards/:cardId', '/api/boards/:boardId/lists/:listId/cards/:cardId',
function(req, res) { function(req, res) {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
const paramCardId = req.params.cardId; const paramCardId = req.params.cardId;
const paramListId = req.params.listId; const paramListId = req.params.listId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
if (req.body.hasOwnProperty('title')) { if (req.body.hasOwnProperty('title')) {
const newTitle = req.body.title; const newTitle = req.body.title;
@ -3855,10 +3855,10 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
'DELETE', 'DELETE',
'/api/boards/:boardId/lists/:listId/cards/:cardId', '/api/boards/:boardId/lists/:listId/cards/:cardId',
function(req, res) { function(req, res) {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
const paramListId = req.params.listId; const paramListId = req.params.listId;
const paramCardId = req.params.cardId; const paramCardId = req.params.cardId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
const card = Cards.findOne({ const card = Cards.findOne({
_id: paramCardId, _id: paramCardId,
@ -3895,10 +3895,10 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
'GET', 'GET',
'/api/boards/:boardId/cardsByCustomField/:customFieldId/:customFieldValue', '/api/boards/:boardId/cardsByCustomField/:customFieldId/:customFieldValue',
function(req, res) { function(req, res) {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
const paramCustomFieldId = req.params.customFieldId; const paramCustomFieldId = req.params.customFieldId;
const paramCustomFieldValue = req.params.customFieldValue; const paramCustomFieldValue = req.params.customFieldValue;
Authentication.checkBoardAccess(req.userId, paramBoardId);
JsonRoutes.sendResult(res, { JsonRoutes.sendResult(res, {
code: 200, code: 200,
data: Cards.find({ data: Cards.find({

6
models/checklistItems.js
View file

@ -265,9 +265,9 @@ if (Meteor.isServer) {
'GET', 'GET',
'/api/boards/:boardId/cards/:cardId/checklists/:checklistId/items/:itemId', '/api/boards/:boardId/cards/:cardId/checklists/:checklistId/items/:itemId',
function(req, res) { function(req, res) {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
const paramItemId = req.params.itemId; const paramItemId = req.params.itemId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
const checklistItem = ChecklistItems.findOne({ _id: paramItemId }); const checklistItem = ChecklistItems.findOne({ _id: paramItemId });
if (checklistItem) { if (checklistItem) {
JsonRoutes.sendResult(res, { JsonRoutes.sendResult(res, {
@ -299,9 +299,9 @@ if (Meteor.isServer) {
'PUT', 'PUT',
'/api/boards/:boardId/cards/:cardId/checklists/:checklistId/items/:itemId', '/api/boards/:boardId/cards/:cardId/checklists/:checklistId/items/:itemId',
function(req, res) { function(req, res) {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
const paramItemId = req.params.itemId; const paramItemId = req.params.itemId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
function isTrue(data) { function isTrue(data) {
try { try {
@ -350,9 +350,9 @@ if (Meteor.isServer) {
'DELETE', 'DELETE',
'/api/boards/:boardId/cards/:cardId/checklists/:checklistId/items/:itemId', '/api/boards/:boardId/cards/:cardId/checklists/:checklistId/items/:itemId',
function(req, res) { function(req, res) {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
const paramItemId = req.params.itemId; const paramItemId = req.params.itemId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
ChecklistItems.direct.remove({ _id: paramItemId }); ChecklistItems.direct.remove({ _id: paramItemId });
JsonRoutes.sendResult(res, { JsonRoutes.sendResult(res, {
code: 200, code: 200,

8
models/checklists.js
View file

@ -248,9 +248,9 @@ if (Meteor.isServer) {
'GET', 'GET',
'/api/boards/:boardId/cards/:cardId/checklists', '/api/boards/:boardId/cards/:cardId/checklists',
function(req, res) { function(req, res) {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
const paramCardId = req.params.cardId; const paramCardId = req.params.cardId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
const checklists = Checklists.find({ cardId: paramCardId }).map(function( const checklists = Checklists.find({ cardId: paramCardId }).map(function(
doc, doc,
) { ) {
@ -292,10 +292,10 @@ if (Meteor.isServer) {
'GET', 'GET',
'/api/boards/:boardId/cards/:cardId/checklists/:checklistId', '/api/boards/:boardId/cards/:cardId/checklists/:checklistId',
function(req, res) { function(req, res) {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
const paramChecklistId = req.params.checklistId; const paramChecklistId = req.params.checklistId;
const paramCardId = req.params.cardId; const paramCardId = req.params.cardId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
const checklist = Checklists.findOne({ const checklist = Checklists.findOne({
_id: paramChecklistId, _id: paramChecklistId,
cardId: paramCardId, cardId: paramCardId,
@ -336,10 +336,10 @@ if (Meteor.isServer) {
'POST', 'POST',
'/api/boards/:boardId/cards/:cardId/checklists', '/api/boards/:boardId/cards/:cardId/checklists',
function(req, res) { function(req, res) {
Authentication.checkUserId(req.userId);
// Check user is logged in // Check user is logged in
//Authentication.checkLoggedIn(req.userId); //Authentication.checkLoggedIn(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
// Check user has permission to add checklist to the card // Check user has permission to add checklist to the card
const board = Boards.findOne({ const board = Boards.findOne({
_id: paramBoardId, _id: paramBoardId,
@ -398,9 +398,9 @@ if (Meteor.isServer) {
'DELETE', 'DELETE',
'/api/boards/:boardId/cards/:cardId/checklists/:checklistId', '/api/boards/:boardId/cards/:cardId/checklists/:checklistId',
function(req, res) { function(req, res) {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
const paramChecklistId = req.params.checklistId; const paramChecklistId = req.params.checklistId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
Checklists.remove({ _id: paramChecklistId }); Checklists.remove({ _id: paramChecklistId });
JsonRoutes.sendResult(res, { JsonRoutes.sendResult(res, {
code: 200, code: 200,

16
models/customFields.js
View file

@ -301,8 +301,8 @@ if (Meteor.isServer) {
req, req,
res, res,
) { ) {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
JsonRoutes.sendResult(res, { JsonRoutes.sendResult(res, {
code: 200, code: 200,
data: CustomFields.find({ boardIds: { $in: [paramBoardId] } }).map( data: CustomFields.find({ boardIds: { $in: [paramBoardId] } }).map(
@ -330,9 +330,9 @@ if (Meteor.isServer) {
'GET', 'GET',
'/api/boards/:boardId/custom-fields/:customFieldId', '/api/boards/:boardId/custom-fields/:customFieldId',
function(req, res) { function(req, res) {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
const paramCustomFieldId = req.params.customFieldId; const paramCustomFieldId = req.params.customFieldId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
JsonRoutes.sendResult(res, { JsonRoutes.sendResult(res, {
code: 200, code: 200,
data: CustomFields.findOne({ data: CustomFields.findOne({
@ -361,8 +361,8 @@ if (Meteor.isServer) {
req, req,
res, res,
) { ) {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
const board = Boards.findOne({ _id: paramBoardId }); const board = Boards.findOne({ _id: paramBoardId });
const id = CustomFields.direct.insert({ const id = CustomFields.direct.insert({
name: req.body.name, name: req.body.name,
@ -406,9 +406,9 @@ if (Meteor.isServer) {
'PUT', 'PUT',
'/api/boards/:boardId/custom-fields/:customFieldId', '/api/boards/:boardId/custom-fields/:customFieldId',
(req, res) => { (req, res) => {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
const paramFieldId = req.params.customFieldId; const paramFieldId = req.params.customFieldId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
if (req.body.hasOwnProperty('name')) { if (req.body.hasOwnProperty('name')) {
CustomFields.direct.update( CustomFields.direct.update(
@ -479,9 +479,9 @@ if (Meteor.isServer) {
'POST', 'POST',
'/api/boards/:boardId/custom-fields/:customFieldId/dropdown-items', '/api/boards/:boardId/custom-fields/:customFieldId/dropdown-items',
(req, res) => { (req, res) => {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
const paramCustomFieldId = req.params.customFieldId; const paramCustomFieldId = req.params.customFieldId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
const paramItems = req.body.items; const paramItems = req.body.items;
if (req.body.hasOwnProperty('items')) { if (req.body.hasOwnProperty('items')) {
@ -522,10 +522,10 @@ if (Meteor.isServer) {
'PUT', 'PUT',
'/api/boards/:boardId/custom-fields/:customFieldId/dropdown-items/:dropdownItemId', '/api/boards/:boardId/custom-fields/:customFieldId/dropdown-items/:dropdownItemId',
(req, res) => { (req, res) => {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
const paramDropdownItemId = req.params.dropdownItemId; const paramDropdownItemId = req.params.dropdownItemId;
const paramCustomFieldId = req.params.customFieldId; const paramCustomFieldId = req.params.customFieldId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
const paramName = req.body.name; const paramName = req.body.name;
if (req.body.hasOwnProperty('name')) { if (req.body.hasOwnProperty('name')) {
@ -563,10 +563,10 @@ if (Meteor.isServer) {
'DELETE', 'DELETE',
'/api/boards/:boardId/custom-fields/:customFieldId/dropdown-items/:dropdownItemId', '/api/boards/:boardId/custom-fields/:customFieldId/dropdown-items/:dropdownItemId',
(req, res) => { (req, res) => {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
paramCustomFieldId = req.params.customFieldId; paramCustomFieldId = req.params.customFieldId;
paramDropdownItemId = req.params.dropdownItemId; paramDropdownItemId = req.params.dropdownItemId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
CustomFields.direct.update( CustomFields.direct.update(
{ _id: paramCustomFieldId }, { _id: paramCustomFieldId },
@ -598,8 +598,8 @@ if (Meteor.isServer) {
'DELETE', 'DELETE',
'/api/boards/:boardId/custom-fields/:customFieldId', '/api/boards/:boardId/custom-fields/:customFieldId',
function(req, res) { function(req, res) {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
const id = req.params.customFieldId; const id = req.params.customFieldId;
CustomFields.remove({ _id: id, boardIds: { $in: [paramBoardId] } }); CustomFields.remove({ _id: id, boardIds: { $in: [paramBoardId] } });
JsonRoutes.sendResult(res, { JsonRoutes.sendResult(res, {

8
models/lists.js
View file

@ -493,8 +493,8 @@ if (Meteor.isServer) {
*/ */
JsonRoutes.add('GET', '/api/boards/:boardId/lists', function(req, res) { JsonRoutes.add('GET', '/api/boards/:boardId/lists', function(req, res) {
try { try {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
JsonRoutes.sendResult(res, { JsonRoutes.sendResult(res, {
code: 200, code: 200,
@ -528,9 +528,9 @@ if (Meteor.isServer) {
res, res,
) { ) {
try { try {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
const paramListId = req.params.listId; const paramListId = req.params.listId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
JsonRoutes.sendResult(res, { JsonRoutes.sendResult(res, {
code: 200, code: 200,
data: Lists.findOne({ data: Lists.findOne({
@ -557,8 +557,8 @@ if (Meteor.isServer) {
*/ */
JsonRoutes.add('POST', '/api/boards/:boardId/lists', function(req, res) { JsonRoutes.add('POST', '/api/boards/:boardId/lists', function(req, res) {
try { try {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
const board = Boards.findOne(paramBoardId); const board = Boards.findOne(paramBoardId);
const id = Lists.insert({ const id = Lists.insert({
title: req.body.title, title: req.body.title,
@ -595,9 +595,9 @@ if (Meteor.isServer) {
res, res,
) { ) {
try { try {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
const paramListId = req.params.listId; const paramListId = req.params.listId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
Lists.remove({ _id: paramListId, boardId: paramBoardId }); Lists.remove({ _id: paramListId, boardId: paramBoardId });
JsonRoutes.sendResult(res, { JsonRoutes.sendResult(res, {
code: 200, code: 200,

10
models/swimlanes.js
View file

@ -399,8 +399,8 @@ if (Meteor.isServer) {
*/ */
JsonRoutes.add('GET', '/api/boards/:boardId/swimlanes', function(req, res) { JsonRoutes.add('GET', '/api/boards/:boardId/swimlanes', function(req, res) {
try { try {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
JsonRoutes.sendResult(res, { JsonRoutes.sendResult(res, {
code: 200, code: 200,
@ -435,9 +435,10 @@ if (Meteor.isServer) {
res, res,
) { ) {
try { try {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
const paramSwimlaneId = req.params.swimlaneId; const paramSwimlaneId = req.params.swimlaneId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
JsonRoutes.sendResult(res, { JsonRoutes.sendResult(res, {
code: 200, code: 200,
data: Swimlanes.findOne({ data: Swimlanes.findOne({
@ -465,8 +466,9 @@ if (Meteor.isServer) {
*/ */
JsonRoutes.add('POST', '/api/boards/:boardId/swimlanes', function(req, res) { JsonRoutes.add('POST', '/api/boards/:boardId/swimlanes', function(req, res) {
try { try {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
const board = Boards.findOne(paramBoardId); const board = Boards.findOne(paramBoardId);
const id = Swimlanes.insert({ const id = Swimlanes.insert({
title: req.body.title, title: req.body.title,
@ -503,9 +505,9 @@ if (Meteor.isServer) {
'/api/boards/:boardId/swimlanes/:swimlaneId', '/api/boards/:boardId/swimlanes/:swimlaneId',
function(req, res) { function(req, res) {
try { try {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId; const paramBoardId = req.params.boardId;
const paramSwimlaneId = req.params.swimlaneId; const paramSwimlaneId = req.params.swimlaneId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
Swimlanes.remove({ _id: paramSwimlaneId, boardId: paramBoardId }); Swimlanes.remove({ _id: paramSwimlaneId, boardId: paramBoardId });
JsonRoutes.sendResult(res, { JsonRoutes.sendResult(res, {
code: 200, code: 200,