mirror of
https://github.com/zadam/trilium.git
synced 2024-09-21 08:06:03 +08:00
allow access to share api root note only if there's share index, #3434
This commit is contained in:
parent
5413a1aa79
commit
db5e76fe8c
|
@ -9,12 +9,6 @@ const beccaService = require("../becca/becca_service");
|
|||
const log = require("./log");
|
||||
|
||||
function cloneNoteToNote(noteId, parentNoteId, prefix) {
|
||||
if (parentNoteId === 'share') {
|
||||
const specialNotesService = require('./special_notes');
|
||||
// share root note is created lazily
|
||||
specialNotesService.getShareRoot();
|
||||
}
|
||||
|
||||
const parentNote = becca.getNote(parentNoteId);
|
||||
|
||||
if (parentNote.type === 'search') {
|
||||
|
|
|
@ -40,9 +40,15 @@ function checkNoteAccess(noteId, req, res) {
|
|||
const note = shaca.getNote(noteId);
|
||||
|
||||
if (!note) {
|
||||
res.setHeader("Content-Type", "text/plain")
|
||||
.status(404)
|
||||
.send(`Note '${noteId}' not found`);
|
||||
res.status(404)
|
||||
.json({ message: `Note '${noteId}' not found` });
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
if (noteId === 'share' && !shaca.shareIndexEnabled) {
|
||||
res.status(403)
|
||||
.json({ message: `Accessing share index is forbidden.` });
|
||||
|
||||
return false;
|
||||
}
|
||||
|
@ -179,9 +185,8 @@ function register(router) {
|
|||
}
|
||||
|
||||
if (!["image", "canvas"].includes(image.type)) {
|
||||
return res.setHeader('Content-Type', 'text/plain')
|
||||
.status(400)
|
||||
.send("Requested note is not a shareable image");
|
||||
return res.status(400)
|
||||
.json({ message: "Requested note is not a shareable image" });
|
||||
} else if (image.type === "canvas") {
|
||||
/**
|
||||
* special "image" type. the canvas is actually type application/json
|
||||
|
@ -196,10 +201,9 @@ function register(router) {
|
|||
res.set('Content-Type', "image/svg+xml");
|
||||
res.set("Cache-Control", "no-cache, no-store, must-revalidate");
|
||||
res.send(svg);
|
||||
} catch(err) {
|
||||
res.setHeader('Content-Type', 'text/plain')
|
||||
.status(500)
|
||||
.send("there was an error parsing excalidraw to svg");
|
||||
} catch (err) {
|
||||
res.status(500)
|
||||
.json({ message: "There was an error parsing excalidraw to svg." });
|
||||
}
|
||||
} else {
|
||||
// normal image
|
||||
|
|
|
@ -47,6 +47,10 @@ class Attribute extends AbstractEntity {
|
|||
if (this.type === 'label' && this.name === 'shareRoot') {
|
||||
this.shaca.shareRootNote = this.note;
|
||||
}
|
||||
|
||||
if (this.type === 'label' && this.name === 'shareIndex') {
|
||||
this.shaca.shareIndexEnabled = true;
|
||||
}
|
||||
}
|
||||
|
||||
/** @returns {boolean} */
|
||||
|
|
|
@ -465,7 +465,11 @@ class Note extends AbstractEntity {
|
|||
type: this.type,
|
||||
mime: this.mime,
|
||||
utcDateModified: this.utcDateModified,
|
||||
attributes: this.getAttributes().map(attr => attr.getPojo()),
|
||||
attributes: this.getAttributes()
|
||||
// relations could link across shared subtrees which might leak them
|
||||
// individual relations might be whitelisted based on needs #3434
|
||||
.filter(attr => attr.type === 'label')
|
||||
.map(attr => attr.getPojo()),
|
||||
parentNoteIds: this.parents.map(parentNote => parentNote.noteId),
|
||||
childNoteIds: this.children.map(child => child.noteId)
|
||||
};
|
||||
|
|
|
@ -20,6 +20,9 @@ class Shaca {
|
|||
/** @type {Note|null} */
|
||||
this.shareRootNote = null;
|
||||
|
||||
/** @type {boolean} true if the index of all shared subtrees is enabled */
|
||||
this.shareIndexEnabled = false;
|
||||
|
||||
this.loaded = false;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue