agw/overleaf-cep
1
0
Fork 0
mirror of https://github.com/yu-i-i/overleaf-cep.git synced 2026-11-12 13:13:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Track changes: fix permissions (#271)

Browse Source 
* track-changes: enforce write and review permissions on review actions

 - Toggling track changes and accepting changes need write access
 - Resolving, reopening and deleting a thread use ensureUserCanDeleteOrResolveThread
 - Deleting a reply needs write or review access, and reviewers may only delete their own replies

* track-changes: leave the reviewer own-reply check out of deleteMessage

 - Deleting a reply is limited by the route only, so reviewers can still delete any reply
This commit is contained in:
Musicminion
2026-11-04 18:28:56 +01:00
committed by GitHub
parent 2da513262a
commit 6c4829eea4
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/web/modules/track-changes/app/src/TrackChangesRouter.mjs
+6 -6
View File
@@ -9,13 +9,13 @@ export default {
webRouter.post(
'/project/:project_id/track_changes',
AuthorizationMiddleware.blockRestrictedUserFromProject,
AuthorizationMiddleware.ensureUserCanReadProject,
AuthorizationMiddleware.ensureUserCanWriteProjectContent,
TrackChangesController.trackChanges
)
webRouter.post(
'/project/:project_id/doc/:doc_id/changes/accept',
AuthorizationMiddleware.blockRestrictedUserFromProject,
AuthorizationMiddleware.ensureUserCanReadProject,
AuthorizationMiddleware.ensureUserCanWriteProjectContent,
TrackChangesController.acceptChanges
)
webRouter.get(
@@ -51,25 +51,25 @@ export default {
webRouter.delete(
'/project/:project_id/thread/:thread_id/messages/:message_id',
AuthorizationMiddleware.blockRestrictedUserFromProject,
AuthorizationMiddleware.ensureUserCanReadProject,
AuthorizationMiddleware.ensureUserCanWriteOrReviewProjectContent,
TrackChangesController.deleteMessage
)
webRouter.post(
'/project/:project_id/doc/:doc_id/thread/:thread_id/resolve',
AuthorizationMiddleware.blockRestrictedUserFromProject,
AuthorizationMiddleware.ensureUserCanReadProject,
AuthorizationMiddleware.ensureUserCanDeleteOrResolveThread,
TrackChangesController.resolveThread
)
webRouter.post(
'/project/:project_id/doc/:doc_id/thread/:thread_id/reopen',
AuthorizationMiddleware.blockRestrictedUserFromProject,
AuthorizationMiddleware.ensureUserCanReadProject,
AuthorizationMiddleware.ensureUserCanDeleteOrResolveThread,
TrackChangesController.reopenThread
)
webRouter.delete(
'/project/:project_id/doc/:doc_id/thread/:thread_id',
AuthorizationMiddleware.blockRestrictedUserFromProject,
AuthorizationMiddleware.ensureUserCanReadProject,
AuthorizationMiddleware.ensureUserCanDeleteOrResolveThread,
TrackChangesController.deleteThread
)
}