github/penpot
1
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2026-05-16 21:43:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

🐛 Set proper permission check on retrieving team users.

Browse Source
This commit is contained in:
Andrey Antukh 2021-01-19 12:53:31 +01:00 committed by Alonso Torres
parent 4fbd2e6caa
commit 15edabc977
2 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
backend/src/app/rpc/queries/teams.clj
View File

@ -147,10 +147,10 @@
(with-open [conn (db/open pool)]
(if team-id
(do
(check-edition-permissions! conn profile-id team-id)
(check-read-permissions! conn profile-id team-id)
(retrieve-users conn team-id))
(let [{team-id :id} (retrieve-team-for-file conn file-id)]
(check-edition-permissions! conn profile-id team-id)
(check-read-permissions! conn profile-id team-id)
(retrieve-users conn team-id)))))
;; This is a similar query to team members but can contain more data

3
frontend/src/app/main/ui.cljs
View File

@ -239,10 +239,9 @@
(defmethod ptk/handle-error :authorization
[error]
(st/emit! (rt/nav :login))
(ts/schedule
(st/emitf (dm/show {:content "Not authorized to see this content."
:timeout 3000
:timeout 2000
:type :error}))))
(defmethod ptk/handle-error :assertion