Prevents accidental overwriting of another users work
This commit is contained in:
@ -242,7 +242,7 @@ router.post('documents.create', auth(), async ctx => {
|
||||
});
|
||||
|
||||
router.post('documents.update', auth(), async ctx => {
|
||||
const { id, title, text } = ctx.body;
|
||||
const { id, title, text, lastRevision } = ctx.body;
|
||||
ctx.assertPresent(id, 'id is required');
|
||||
ctx.assertPresent(title || text, 'title or text is required');
|
||||
|
||||
@ -250,6 +250,10 @@ router.post('documents.update', auth(), async ctx => {
|
||||
const document = await Document.findById(id);
|
||||
const collection = document.collection;
|
||||
|
||||
if (lastRevision && lastRevision !== document.revisionCount) {
|
||||
throw httpErrors.BadRequest('Document has changed since last revision');
|
||||
}
|
||||
|
||||
authDocumentForUser(ctx, document);
|
||||
|
||||
// Update document
|
||||
|
Reference in New Issue
Block a user