diff options
Diffstat (limited to 'models/cards.js')
-rw-r--r-- | models/cards.js | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/models/cards.js b/models/cards.js index 816132fe..496c69b3 100644 --- a/models/cards.js +++ b/models/cards.js @@ -2003,8 +2003,15 @@ if (Meteor.isServer) { req, res, ) { - Authentication.checkUserId(req.userId); + // Check user is logged in + Authentication.checkLoggedIn(req.userId); const paramBoardId = req.params.boardId; + // Check user has permission to add card to the board + const board = Boards.findOne({ + _id: paramBoardId + }); + const addPermission = allowIsBoardMemberCommentOnly(req.userId, board); + Authentication.checkAdminOrCondition(req.userId, addPermission); const paramListId = req.params.listId; const paramParentId = req.params.parentId; const currentCards = Cards.find( |