Allow board members to use more of API. Please add issue (or pull request) if this allows too much.

Thanks to JayVii and xet7 !

Fixes #3862
This commit is contained in:
Lauri Ojansivu 2021-06-14 15:01:37 +03:00
parent 50fa8a0743
commit a719e8fda1
8 changed files with 40 additions and 25 deletions

View file

@ -3308,8 +3308,8 @@ if (Meteor.isServer) {
'PUT',
'/api/boards/:boardId/lists/:listId/cards/:cardId',
function(req, res) {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
const paramCardId = req.params.cardId;
const paramListId = req.params.listId;
@ -3666,8 +3666,8 @@ if (Meteor.isServer) {
'DELETE',
'/api/boards/:boardId/lists/:listId/cards/:cardId',
function(req, res) {
Authentication.checkUserId(req.userId);
const paramBoardId = req.params.boardId;
Authentication.checkBoardAccess(req.userId, paramBoardId);
const paramListId = req.params.listId;
const paramCardId = req.params.cardId;