Преглед изворни кода

fix to check page existing and read permission

yusuketk пре 5 година
родитељ
комит
14623905ed
1 измењених фајлова са 6 додато и 12 уклоњено
  1. 6 12
      src/server/routes/apiv3/page.js

+ 6 - 12
src/server/routes/apiv3/page.js

@@ -203,30 +203,24 @@ module.exports = (crowi) => {
       const { pageId } = req.params;
       const { format, revisionId = null } = req.query;
 
+      const Page = crowi.model('Page');
       const page = await Page.findByIdAndViewer(pageId, req.user);
 
       if (page == null) {
-        const isAccessible = await Page.isAccessiblePageByViewer(pageId, req.user);
-        if (isAccessible) {
+        const isPageExist = await Page.findById(pageId);
+        if (isPageExist) {
+          // This page exists but req.user has not read permission
           return res.apiv3Err(new ErrorV3(`Haven't the right to see the page ${pageId}.`), 403);
         }
         return res.apiv3Err(new ErrorV3(`Page ${pageId} is not exist.`), 404);
       }
 
-      let revisionIdForFind;
-      if (revisionId == null) {
-        const Page = crowi.model('Page');
-        const page = await Page.findByIdAndViewer(pageId);
-        revisionIdForFind = page.revision;
-      }
-      else {
-        revisionIdForFind = revisionId;
-      }
+      const revisionIdForFind = revisionId || page.revision;
 
       const Revision = crowi.model('Revision');
       const revision = await Revision.findById(revisionIdForFind);
 
-      const fileName = revisionId;
+      const fileName = revisionIdForFind;
       const stream = exportService.getReadStreamFromRevision(revision);
 
       res.set({