coop-cloud-chaos-patchs/outline
Archived
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fix: prevent access to docs in trash from deleted private collections (#2431)

Browse Source 
* Check for collection in deleted document

* Add tests

* Use update policy

* Set paranoid to false when fetching deleted doc

* Update policy
This commit is contained in:
Saumya Pandey
2021-08-26 09:35:59 +05:30
committed by GitHub
parent d335670b91
commit 22ba4d0f48
4 changed files with 77 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
server/models/Document.js
View File

@ -163,7 +163,7 @@ Document.associate = (models) => {
},
},
});
Document.addScope("withCollection", (userId) => {
Document.addScope("withCollection", (userId, paranoid = true) => {
if (userId) {
return {
include: [
@ -172,6 +172,7 @@ Document.associate = (models) => {
method: ["withMembership", userId],
}),
as: "collection",
paranoid,
},
],
};
@ -221,7 +222,7 @@ Document.findByPk = async function (id, options = {}) {
const scope = this.scope(
"withUnpublished",
{
method: ["withCollection", options.userId],
method: ["withCollection", options.userId, options.paranoid],
},
{
method: ["withViews", options.userId],