mirror/advplyr.audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2025-06-28 19:50:23 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add:Restrict user permissions by tag

Browse source
This commit is contained in:
advplyr 2022-03-20 06:29:08 -05:00
parent f8d0384155
commit 27f1bd90f9
6 changed files with 114 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

5
server/controllers/LibraryItemController.js
View file

@ -262,6 +262,11 @@ class LibraryItemController {
return res.sendStatus(403)
}
// Check user can access this library item
if (!req.user.checkCanAccessLibraryItemWithTags(item.media.tags)) {
return res.sendStatus(403)
}
if (req.method == 'DELETE' && !req.user.canDelete) {
Logger.warn(`[LibraryItemController] User attempted to delete without permission`, req.user)
return res.sendStatus(403)