usememos/memos
1
1
Fork 0
mirror of https://github.com/usememos/memos.git synced 2025-02-26 22:34:17 +08:00
Code Issues Projects Releases Packages Wiki Activity

fix: visibility param override the user auth state (#1942)

Browse source 
fix visibility param override the user auth state
This commit is contained in:
Athurg Gooth 2023-07-13 15:20:15 +08:00 committed by GitHub
parent 11aa01ee2e
commit 3093f80d68
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 8 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
api/v1/memo.go
View file

@ -6,7 +6,6 @@ import (
"fmt" "fmt"
"net/http" "net/http"
"strconv" "strconv"
"strings"
"time" "time"
"github.com/labstack/echo/v4" "github.com/labstack/echo/v4"
@ -357,16 +356,21 @@ func (s *APIV1Service) registerMemoRoutes(g *echo.Group) {
currentUserID, ok := c.Get(getUserIDContextKey()).(int) currentUserID, ok := c.Get(getUserIDContextKey()).(int)
if !ok { if !ok {
// Anonymous use should only fetch PUBLIC memos with specified user
if findMemoMessage.CreatorID == nil { if findMemoMessage.CreatorID == nil {
return echo.NewHTTPError(http.StatusBadRequest, "Missing user id to find memo") return echo.NewHTTPError(http.StatusBadRequest, "Missing user id to find memo")
} }
findMemoMessage.VisibilityList = []store.Visibility{store.Public} findMemoMessage.VisibilityList = []store.Visibility{store.Public}
} else { } else {
if findMemoMessage.CreatorID == nil { // Authorized user can fetch all PUBLIC/PROTECTED memo
visibilityList := []store.Visibility{store.Public, store.Protected}
// If Creator is authorized user (as default), PRIVATE memo is OK
if findMemoMessage.CreatorID == nil || *findMemoMessage.CreatorID == currentUserID {
findMemoMessage.CreatorID = &currentUserID findMemoMessage.CreatorID = &currentUserID
} else { visibilityList = append(visibilityList, store.Private)
findMemoMessage.VisibilityList = []store.Visibility{store.Public, store.Protected}
} }
findMemoMessage.VisibilityList = visibilityList
} }
rowStatus := store.RowStatus(c.QueryParam("rowStatus")) rowStatus := store.RowStatus(c.QueryParam("rowStatus"))
@ -390,14 +394,6 @@ func (s *APIV1Service) registerMemoRoutes(g *echo.Group) {
} }
findMemoMessage.ContentSearch = contentSearch findMemoMessage.ContentSearch = contentSearch
visibilityListStr := c.QueryParam("visibility")
if visibilityListStr != "" {
visibilityList := []store.Visibility{}
for _, visibility := range strings.Split(visibilityListStr, ",") {
visibilityList = append(visibilityList, store.Visibility(visibility))
}
findMemoMessage.VisibilityList = visibilityList
}
if limit, err := strconv.Atoi(c.QueryParam("limit")); err == nil { if limit, err := strconv.Atoi(c.QueryParam("limit")); err == nil {
findMemoMessage.Limit = &limit findMemoMessage.Limit = &limit
} }