coop-cloud-chaos-patchs/outline
coop-cloud-chaos-patchs
/
outline
Archived
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fix: Server error when loading documents.info with shareId and user token and child documents shared 

closes #2527
This commit is contained in:
Tom Moor 2021-09-01 23:38:43 -07:00
parent 476b5e03f9
commit a3df9e868f
2 changed files with 35 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
server/routes/api/documents.js
View File

@ -541,8 +541,7 @@ async function loadDocument({
const canReadDocument = can(user, "read", document);
if (canReadDocument) {
await share.update({ lastAccessedAt: new Date() });
return { document, share, collection };
return { document, share, collection: document.collection };
}
// "published" === on the public internet.

67
server/routes/api/documents.test.js
View File

@ -267,23 +267,45 @@ describe("#documents.info", () => {
});
expect(res.status).toEqual(403);
});
});
it("should not return document from shareId if sharing is disabled for team", async () => {
const { document, team, user } = await seed();
const share = await buildShare({
documentId: document.id,
teamId: document.teamId,
userId: user.id,
it("should not return document from shareId if sharing is disabled for team", async () => {
const { document, team, user } = await seed();
const share = await buildShare({
documentId: document.id,
teamId: document.teamId,
userId: user.id,
});
team.sharing = false;
await team.save();
const res = await server.post("/api/documents.info", {
body: { shareId: share.id, apiVersion: 2 },
});
expect(res.status).toEqual(403);
});
team.sharing = false;
await team.save();
it("should return document from shareId if public sharing is disabled but the user has permission to read", async () => {
const { document, collection, team, user } = await seed();
const share = await buildShare({
includeChildDocuments: true,
documentId: document.id,
teamId: document.teamId,
userId: user.id,
});
const res = await server.post("/api/documents.info", {
body: { shareId: share.id },
team.sharing = false;
await team.save();
collection.sharing = false;
await collection.save();
const res = await server.post("/api/documents.info", {
body: { token: user.getJwtToken(), shareId: share.id, apiVersion: 2 },
});
expect(res.status).toEqual(200);
});
expect(res.status).toEqual(403);
});
it("should not return document from shareId if sharing is disabled for collection", async () => {
@ -303,27 +325,6 @@ describe("#documents.info", () => {
expect(res.status).toEqual(403);
});
it("should return document from shareId if public sharing is disabled but the user has permission to read", async () => {
const { document, collection, team, user } = await seed();
const share = await buildShare({
documentId: document.id,
teamId: document.teamId,
userId: user.id,
});
team.sharing = false;
await team.save();
collection.sharing = false;
await collection.save();
const res = await server.post("/api/documents.info", {
body: { token: user.getJwtToken(), shareId: share.id },
});
expect(res.status).toEqual(200);
});
it("should not return document from revoked shareId", async () => {
const { document, user } = await seed();
const share = await buildShare({