Merge pull request #14 from crowi/fix-error-on-access-to-restricted-page

Fix: Error on accessing to restricted page

models/page.js

@@ -221,19 +221,31 @@ module.exports = function(app, models) {
       });
   };
 
-  pageSchema.statics.findPageById = function(id, userData, cb) {
+  pageSchema.statics.findPageById = function(id, cb) {
     var Page = this;
 
-    this.findOne({_id: id}, function(err, pageData) {
+    Page.findOne({_id: id}, function(err, pageData) {
       if (pageData === null) {
         return cb(new Error('Page Not Found'), null);
       }
 
-      if (!pageData.isGrantedFor(userData)) {
+      return populatePageData(pageData, null, cb);
+    });
+  };
+
+  pageSchema.statics.findPageByIdAndGrantedUser = function(id, userData, cb) {
+    var Page = this;
+
+    Page.findPageById(id, function(err, pageData) {
+      if (pageData === null) {
+        return cb(new Error('Page Not Found'), null);
+      }
+
+      if (userData && !pageData.isGrantedFor(userData)) {
         return cb(PAGE_GRANT_ERROR, null);
       }
 
-      return populatePageData(pageData, null, cb);
+      return cb(null,pageData);
     });
   };
 

routes/index.js

@@ -56,7 +56,8 @@ module.exports = function(app) {
   app.post('/me/auth/google'         , middleware.loginRequired(app) , me.authGoogle);
   app.get('/me/auth/google/callback' , middleware.loginRequired(app) , me.authGoogleCallback);
 
-  app.get('/_r/:id'                  , middleware.loginRequired(app) , page.api.redirector);
+  app.get('/:id([0-9a-z]{24})'       , middleware.loginRequired(app) , page.api.redirector);
+  app.get('/_r/:id([0-9a-z]{24})'    , middleware.loginRequired(app) , page.api.redirector); // alias
   app.get('/_api/check_username'     , user.api.checkUsername);
   app.post('/_api/me/picture/upload' , middleware.loginRequired(app) , me.api.uploadPicture);
   app.get('/_api/user/bookmarks'     , middleware.loginRequired(app) , user.api.bookmarks);

routes/page.js

@@ -188,7 +188,7 @@ module.exports = function(app) {
       return res.redirect(d.path);
     };
 
-    Page.findPageById(id, req.user, function(err, pageData) {
+    Page.findPageById(id, function(err, pageData) {
       if (pageData) {
         if (pageData.grant == Page.GRANT_RESTRICTED && !pageData.isGrantedFor(req.user)) {
           return Page.pushToGrantedUsers(pageData, req.user, cb);
@@ -219,7 +219,7 @@ module.exports = function(app) {
 
   api.bookmark = function(req, res){
     var id = req.params.id;
-    Page.findPageById(id, req.user, function(err, pageData) {
+    Page.findPageByIdAndGrantedUser(id, req.user, function(err, pageData) {
       if (pageData) {
         Bookmark.add(pageData, req.user, function(err, data) {
           return res.json({status: true});
@@ -235,7 +235,7 @@ module.exports = function(app) {
    */
   api.like = function(req, res){
     var id = req.params.id;
-    Page.findPageById(id, req.user, function(err, pageData) {
+    Page.findPageByIdAndGrantedUser(id, req.user, function(err, pageData) {
       if (pageData) {
         pageData.like(req.user, function(err, data) {
           return res.json({status: true});
@@ -252,7 +252,7 @@ module.exports = function(app) {
   api.unlike = function(req, res){
     var id = req.params.id;
 
-    Page.findPageById(id, req.user, function(err, pageData) {
+    Page.findPageByIdAndGrantedUser(id, req.user, function(err, pageData) {
       if (pageData) {
         pageData.unlike(req.user, function(err, data) {
           return res.json({status: true});