diff options
| author | Ghassen Rjab <rjab.ghassen@gmail.com> | 2017-07-30 04:27:38 +0100 |
|---|---|---|
| committer | Ghassen Rjab <rjab.ghassen@gmail.com> | 2017-07-30 04:27:38 +0100 |
| commit | f521b7949a82a23697f441c523ce69a7591d735c (patch) | |
| tree | 2941e709bcee4a0cc25907db3657870e8b6bc73b /models/attachments.js | |
| parent | f9f529e53f980d889df5bb1f818da55268284535 (diff) | |
| download | wekan-f521b7949a82a23697f441c523ce69a7591d735c.tar.gz wekan-f521b7949a82a23697f441c523ce69a7591d735c.tar.bz2 wekan-f521b7949a82a23697f441c523ce69a7591d735c.zip | |
Fix files access bug
Diffstat (limited to 'models/attachments.js')
| -rw-r--r-- | models/attachments.js | 18 |
1 files changed, 6 insertions, 12 deletions
diff --git a/models/attachments.js b/models/attachments.js index d8398816..1c9878c7 100644 --- a/models/attachments.js +++ b/models/attachments.js @@ -21,19 +21,13 @@ if (Meteor.isServer) { // We authorize the attachment download either: // - if the board is public, everyone (even unconnected) can download it // - if the board is private, only board members can download it - // - // XXX We have a bug with the `userId` verification: - // - // https://github.com/CollectionFS/Meteor-CollectionFS/issues/449 - // download(userId, doc) { - const query = { - $or: [ - { 'members.userId': userId }, - { permission: 'public' }, - ], - }; - return Boolean(Boards.findOne(doc.boardId, query)); + const board = Boards.findOne(doc.boardId); + if (board.isPublic()) { + return true; + } else { + return board.hasMember(userId); + } }, fetch: ['boardId'], |