Commit a0e2f5e6 authored by les's avatar les
Browse files

[fix] confirm/unconfirm event permission

parent e467a289
...@@ -124,6 +124,9 @@ const eventController = { ...@@ -124,6 +124,9 @@ const eventController = {
const id = Number(req.params.event_id) const id = Number(req.params.event_id)
const event = await Event.findByPk(id) const event = await Event.findByPk(id)
if (!event) { return res.sendStatus(404) } if (!event) { return res.sendStatus(404) }
if (!req.user.is_admin && req.user.id !== event.userId) {
return res.sendStatus(403)
}
try { try {
event.is_visible = true event.is_visible = true
...@@ -143,6 +146,9 @@ const eventController = { ...@@ -143,6 +146,9 @@ const eventController = {
const id = Number(req.params.event_id) const id = Number(req.params.event_id)
const event = await Event.findByPk(id) const event = await Event.findByPk(id)
if (!event) { return req.sendStatus(404) } if (!event) { return req.sendStatus(404) }
if (!req.user.is_admin && req.user.id !== event.userId) {
return res.sendStatus(403)
}
try { try {
event.is_visible = false event.is_visible = false
......
...@@ -83,8 +83,8 @@ api.post('/settings', fillUser, isAdmin, settingsController.setRequest) ...@@ -83,8 +83,8 @@ api.post('/settings', fillUser, isAdmin, settingsController.setRequest)
api.get('/settings/user_locale', settingsController.getUserLocale) api.get('/settings/user_locale', settingsController.getUserLocale)
// confirm event // confirm event
api.get('/event/confirm/:event_id', isAuth, isAdmin, eventController.confirm) api.get('/event/confirm/:event_id', isAuth, eventController.confirm)
api.get('/event/unconfirm/:event_id', isAuth, isAdmin, eventController.unconfirm) api.get('/event/unconfirm/:event_id', isAuth, eventController.unconfirm)
// get event // get event
api.get('/event/:event_id.:format?', fillUser, eventController.get) api.get('/event/:event_id.:format?', fillUser, eventController.get)
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment