From 57a34e940e31d7a027073811f6d9b3da52a49a62 Mon Sep 17 00:00:00 2001
From: James Allen <james@sharelatex.com>
Date: Mon, 24 Nov 2014 12:05:05 +0000
Subject: [PATCH] Authorize users before updating their cursor positions

---
 .../app/coffee/WebsocketController.coffee     | 41 ++++++++++---------
 .../coffee/WebsocketControllerTests.coffee    |  1 +
 2 files changed, 23 insertions(+), 19 deletions(-)

diff --git a/services/real-time/app/coffee/WebsocketController.coffee b/services/real-time/app/coffee/WebsocketController.coffee
index 73f327d22f..add10011b0 100644
--- a/services/real-time/app/coffee/WebsocketController.coffee
+++ b/services/real-time/app/coffee/WebsocketController.coffee
@@ -113,25 +113,28 @@ module.exports = WebsocketController =
 		], (error, {project_id, first_name, last_name, email, user_id}) ->
 			return callback(error) if error?
 			logger.log {user_id, project_id, client_id: client.id, cursorData: cursorData}, "updating client position"
-			cursorData.id      = client.id
-			cursorData.user_id = user_id if user_id?
-			cursorData.email   = email   if email?
-			if first_name? and last_name?
-				cursorData.name = first_name + " " + last_name
-				ConnectedUsersManager.updateUserPosition(project_id, client.id, {
-					first_name: first_name,
-					last_name:  last_name,
-					email:      email,
-					user_id:    user_id
-				}, {
-					row:    cursorData.row,
-					column: cursorData.column,
-					doc_id: cursorData.doc_id
-				}, callback)
-			else
-				cursorData.name = "Anonymous"
-				callback()
-			WebsocketLoadBalancer.emitToRoom(project_id, "clientTracking.clientUpdated", cursorData)
+					
+			AuthorizationManager.assertClientCanViewProject client, (error) ->
+				return callback(error) if error?
+				cursorData.id      = client.id
+				cursorData.user_id = user_id if user_id?
+				cursorData.email   = email   if email?
+				if first_name? and last_name?
+					cursorData.name = first_name + " " + last_name
+					ConnectedUsersManager.updateUserPosition(project_id, client.id, {
+						first_name: first_name,
+						last_name:  last_name,
+						email:      email,
+						user_id:    user_id
+					}, {
+						row:    cursorData.row,
+						column: cursorData.column,
+						doc_id: cursorData.doc_id
+					}, callback)
+				else
+					cursorData.name = "Anonymous"
+					callback()
+				WebsocketLoadBalancer.emitToRoom(project_id, "clientTracking.clientUpdated", cursorData)
 		
 	getConnectedUsers: (client, callback = (error, users) ->) ->
 		metrics.inc "editor.get-connected-users"
diff --git a/services/real-time/test/unit/coffee/WebsocketControllerTests.coffee b/services/real-time/test/unit/coffee/WebsocketControllerTests.coffee
index 5d2e63cc03..ea37cb38ec 100644
--- a/services/real-time/test/unit/coffee/WebsocketControllerTests.coffee
+++ b/services/real-time/test/unit/coffee/WebsocketControllerTests.coffee
@@ -298,6 +298,7 @@ describe 'WebsocketController', ->
 		beforeEach ->
 			@WebsocketLoadBalancer.emitToRoom = sinon.stub()
 			@ConnectedUsersManager.updateUserPosition = sinon.stub().callsArgWith(4)
+			@AuthorizationManager.assertClientCanViewProject = sinon.stub().callsArgWith(1, null)
 			@update = {
 				doc_id: @doc_id = "doc-id-123"
 				row: @row = 42