local-it/vikunja-api
0
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Fixed a bug where a user could see every namespace

Browse source
This commit is contained in:
konrad 2018-09-06 08:39:05 +02:00 committed by kolaente
parent f2758e239c
commit 92174aac08
No known key found for this signature in database
GPG key ID: F40E70337AB24C9B
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
models/namespace_rights.go
View file

@ -67,8 +67,9 @@ func (n *Namespace) checkTeamRights(user *User, r TeamRight) bool {
Table("namespaces").
Join("LEFT", "team_namespaces", "namespaces.id = team_namespaces.namespace_id").
Join("LEFT", "team_members", "team_members.team_id = team_namespaces.team_id").
Where("team_members.user_id = ? AND team_namespaces.right = ?", user.ID, r).
Or("namespaces.owner_id = ?", user.ID).
Where("namespaces.id = ? " +
"AND ((team_members.user_id = ? AND team_namespaces.right = ?) " +
"OR namespaces.owner_id = ?)", n.ID, user.ID, r, user.ID).
Get(&Namespace{})
if err != nil {