From f521b7949a82a23697f441c523ce69a7591d735c Mon Sep 17 00:00:00 2001
From: Ghassen Rjab <rjab.ghassen@gmail.com>
Date: Sun, 30 Jul 2017 04:27:38 +0100
Subject: Fix files access bug

---
 models/attachments.js | 18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)

diff --git a/models/attachments.js b/models/attachments.js
index d8398816..1c9878c7 100644
--- a/models/attachments.js
+++ b/models/attachments.js
@@ -21,19 +21,13 @@ if (Meteor.isServer) {
     // We authorize the attachment download either:
     // - if the board is public, everyone (even unconnected) can download it
     // - if the board is private, only board members can download it
-    //
-    // XXX We have a bug with the `userId` verification:
-    //
-    //   https://github.com/CollectionFS/Meteor-CollectionFS/issues/449
-    //
     download(userId, doc) {
-      const query = {
-        $or: [
-          { 'members.userId': userId },
-          { permission: 'public' },
-        ],
-      };
-      return Boolean(Boards.findOne(doc.boardId, query));
+      const board = Boards.findOne(doc.boardId);
+      if (board.isPublic()) {
+        return true;
+      } else {
+        return board.hasMember(userId);
+      }
     },
 
     fetch: ['boardId'],
-- 
cgit v1.2.3-1-g7c22