watson/umami
1
0
Fork 0
mirror of https://github.com/umami-software/umami.git synced 2025-12-08 05:12:36 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

Fixed share token check.

Browse source
This commit is contained in:
Mike Cao 2022-11-16 11:44:36 -08:00
parent 091716e037
commit 8722b794d9
2 changed files with 6 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

11
lib/auth.js
View file

@ -50,12 +50,9 @@ export function isValidToken(token, validation) {
export async function allowQuery(req, type) { export async function allowQuery(req, type) {
const { id } = req.query; const { id } = req.query;
const { const { user, shareToken } = req.auth;
user: { id: userId, isAdmin },
shareToken,
} = req.auth;
if (isAdmin) { if (user?.isAdmin) {
return true; return true;
} }
@ -63,11 +60,11 @@ export async function allowQuery(req, type) {
return isValidToken(shareToken, { id }); return isValidToken(shareToken, { id });
} }
if (userId) { if (user?.id) {
if (type === TYPE_WEBSITE) { if (type === TYPE_WEBSITE) {
const website = await getWebsite({ id }); const website = await getWebsite({ id });
return website && website.userId === userId; return website && website.userId === user.id;
} else if (type === TYPE_USER) { } else if (type === TYPE_USER) {
const user = await getUser({ id }); const user = await getUser({ id });

4
lib/middleware.js
View file

@ -29,12 +29,12 @@ export const useAuth = createMiddleware(async (req, res, next) => {
const payload = parseSecureToken(token, secret()); const payload = parseSecureToken(token, secret());
const shareToken = await parseShareToken(req); const shareToken = await parseShareToken(req);
let user; let user = null;
const { userId, key } = payload || {}; const { userId, key } = payload || {};
if (validate(userId)) { if (validate(userId)) {
user = await getUser({ id: userId }); user = await getUser({ id: userId });
} else if (redis.enabled) { } else if (redis.enabled && key) {
user = await redis.get(key); user = await redis.get(key);
} }