From 071dffe8f24fb8c90268ac63124c0b983c559bb6 Mon Sep 17 00:00:00 2001 From: Phillip Thelen Date: Thu, 28 Feb 2019 15:27:58 +0100 Subject: [PATCH] =?UTF-8?q?Add=20check=20to=20make=20sure=20users=20don?= =?UTF-8?q?=E2=80=99t=20search=20for=20parties/guilds=20they=20are=20not?= =?UTF-8?q?=20part=20of?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- website/server/controllers/api-v4/members.js | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/website/server/controllers/api-v4/members.js b/website/server/controllers/api-v4/members.js index 748558e845..ac07b4b7e0 100644 --- a/website/server/controllers/api-v4/members.js +++ b/website/server/controllers/api-v4/members.js @@ -1,4 +1,5 @@ import {model as User} from '../../models/user'; +import {authWithHeaders} from '../../middlewares/auth'; let api = {}; @@ -6,7 +7,7 @@ let api = {}; api.getUsernameAutocompletes = { method: 'GET', url: '/members/find/:username', - middlewares: [], + middlewares: [authWithHeaders()], async handler (req, res) { res.set('Cache-Control', 'public, max-age=300000'); // 5 minutes req.checkParams('username', res.t('invalidReqParams')).notEmpty(); @@ -28,12 +29,16 @@ api.getUsernameAutocompletes = { let id = req.query.id; if (context && id) { if (context === 'party') { - query['party._id'] = id; + query['party._id'] = res.locals.user.party._id; } else if (context === 'privateGuild') { - query.guilds = id; + if (res.locals.user.guilds.includes(id)) { + query.guilds = id; + } } } + console.log(query); + let members = await User .find(query) .select(['profile.name', 'contributor', 'auth.local.username'])