jyapayne/nimforum
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add server side checking for user permissions

Browse source
This commit is contained in:
Joey Yakimowich-Payne 2018-08-07 21:03:05 +09:00
commit a05667ef78
1 changed files with 11 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

12
src/forum.nim
View file

@ -520,6 +520,16 @@ proc updatePost(c: TForumData, postId: int, content: string,
if row[0] == $postId: if row[0] == $postId:
exec(db, crud(crUpdate, "thread", "name"), subject.get(), threadId) exec(db, crud(crUpdate, "thread", "name"), subject.get(), threadId)
proc updateThread(c: TForumData, threadId: string, queryKeys: seq[string], queryValues: seq[string]) =
let threadAuthor = selectThreadAuthor(threadId.parseInt)
# Verify that the current user has permissions to edit the specified thread.
let canEdit = c.rank == Admin or c.userid == threadAuthor.name
if not canEdit:
raise newForumError("You cannot edit this thread")
exec(db, crud(crUpdate, "thread", queryKeys), queryValues)
proc executeNewThread(c: TForumData, subject, msg, categoryID: string): (int64, int64) = proc executeNewThread(c: TForumData, subject, msg, categoryID: string): (int64, int64) =
const const
query = sql""" query = sql"""
@ -1181,7 +1191,7 @@ routes:
if queryKeys.len() > 0: if queryKeys.len() > 0:
queryValues.add(threadId) queryValues.add(threadId)
try: try:
exec(db, crud(crUpdate, "thread", queryKeys), queryValues) updateThread(c, threadId, queryKeys, queryValues)
resp Http200, "{}", "application/json" resp Http200, "{}", "application/json"
except ForumError as exc: except ForumError as exc:
resp Http400, $(%exc.data), "application/json" resp Http400, $(%exc.data), "application/json"