From 058aabff68ceb822edb74248f1263da6590cbe1e Mon Sep 17 00:00:00 2001 From: mayjs Date: Tue, 16 May 2017 10:52:55 +0200 Subject: Implemented the change of /api/user/boards as proposed by huneau --- models/boards.js | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'models') diff --git a/models/boards.js b/models/boards.js index 366a680a..5908dee9 100644 --- a/models/boards.js +++ b/models/boards.js @@ -556,8 +556,12 @@ if (Meteor.isServer) { //BOARDS REST API if (Meteor.isServer) { - JsonRoutes.add('GET', '/api/user/boards', function (req, res, next) { + JsonRoutes.add('GET', '/api/user/:userId/boards', function (req, res, next) { Authentication.checkLoggedIn(req.userId); + const paramUserId = req.params.userId; + // A normal user should be able to see their own boards, + // admins can access boards of any user + Authentication.checkAdminOrCondition(req.userId, req.userId === paramUserId); const data = Boards.find({ archived: false, -- cgit v1.2.3-1-g7c22