mirrors/TiddlyWiki5
1
0
Fork 0
mirror of https://github.com/Jermolene/TiddlyWiki5 synced 2025-01-09 17:00:27 +00:00
Code Issues Releases Wiki Activity

Feature/#8812 anon access fix (#8815)

Browse Source 
* #8812 resolve issue with anonymous access

* #8812 bug fix with anonymous access
This commit is contained in:
webplusai 2024-12-14 11:00:14 +01:00 committed by GitHub
parent ae5bd9d4cd
commit 67232aab15
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
plugins/tiddlywiki/multiwikiserver/modules/routes/helpers/acl-middleware.js
View File

@ -47,7 +47,7 @@ exports.middleware = function (request, response, state, entityType, permissionN
var decodedEntityName = decodeURIComponent(partiallyDecoded); var decodedEntityName = decodeURIComponent(partiallyDecoded);
var aclRecord = sqlTiddlerDatabase.getACLByName(entityType, decodedEntityName); var aclRecord = sqlTiddlerDatabase.getACLByName(entityType, decodedEntityName);
var isGetRequest = request.method === "GET"; var isGetRequest = request.method === "GET";
var hasAnonymousAccess = state.allowAnon && (isGetRequest ? state.allowAnonReads : state.allowAnonWrites); var hasAnonymousAccess = state.allowAnon ? (isGetRequest ? state.allowAnonReads : state.allowAnonWrites) : false;
var entity = sqlTiddlerDatabase.getEntityByName(entityType, decodedEntityName); var entity = sqlTiddlerDatabase.getEntityByName(entityType, decodedEntityName);
if(entity?.owner_id) { if(entity?.owner_id) {
if(state.authenticatedUser?.user_id && (state.authenticatedUser?.user_id !== entity.owner_id) || !state.authenticatedUser?.user_id && !hasAnonymousAccess) { if(state.authenticatedUser?.user_id && (state.authenticatedUser?.user_id !== entity.owner_id) || !state.authenticatedUser?.user_id && !hasAnonymousAccess) {
@ -59,7 +59,7 @@ exports.middleware = function (request, response, state, entityType, permissionN
} }
} else { } else {
// First, we need to check if anonymous access is allowed // First, we need to check if anonymous access is allowed
if(!state.authenticatedUser?.user_id && !hasAnonymousAccess && (isGetRequest && entity?.owner_id)) { if(!state.authenticatedUser?.user_id && !hasAnonymousAccess) {
if(!response.headersSent) { if(!response.headersSent) {
response.writeHead(401, "Unauthorized"); response.writeHead(401, "Unauthorized");
response.end(); response.end();