Andreas/wekan
1
0
Fork 0
mirror of https://github.com/wekan/wekan.git synced 2026-01-02 15:48:49 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Export Wekan now server-based with proper auth

Browse source
This commit is contained in:
Xavier Priour 2015-12-16 21:54:35 +01:00
parent efe7c21d57
commit d08e1cc45b
6 changed files with 42 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

30
models/export.js
View file

@ -1,11 +1,30 @@
/* global JsonRoutes */
if(Meteor.isServer) {
JsonRoutes.add('get', '/api/b/:boardId/:userId/:loginToken', function (req, res) {
const { userId, loginToken, boardId } = req.params;
const hashToken = Accounts._hashLoginToken(loginToken);
const user = Meteor.users.findOne({
_id: userId,
'services.resume.loginTokens.hashedToken': hashToken,
});
const exporter = new Exporter(boardId);
if(user && exporter.canExport(user)) {
JsonRoutes.sendResult(res, 200, exporter.build());
} else {
// we could send an explicit error message, but on the other
// hand the only way to get there is by hacking the UI so...
JsonRoutes.sendResult(res, 403);
}
});
}
Meteor.methods({
exportBoard(boardId) {
check(boardId, String);
const board = Boards.findOne(boardId);
if(board.isVisibleByUser()) {
const exporter = new Exporter(boardId);
const exporter = new Exporter(boardId);
if(exporter.canExport(Meteor.user())) {
return exporter.build();
} else {
throw new Meteor.Error('error-board-notAMember');
@ -56,4 +75,9 @@ class Exporter {
result.users = Users.find(byUserIds, userFields).fetch();
return result;
}
canExport(user) {
const board = Boards.findOne(this._boardId);
return board && board.isVisibleBy(user);
}
}