luisgulo/focalboard
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

update handleServeFile to allow readtoken

Browse source
This commit is contained in:
Scott Bishel 2022-03-31 15:02:49 -06:00
parent 36bf5704d0
commit c098eda254
1 changed files with 10 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
server/api/api.go
View file

@ -1824,7 +1824,7 @@ func (a *API) handlePostTeamRegenerateSignupToken(w http.ResponseWriter, r *http
// File upload // File upload
func (a *API) handleServeFile(w http.ResponseWriter, r *http.Request) { func (a *API) handleServeFile(w http.ResponseWriter, r *http.Request) {
// swagger:operation GET /boards/{boardID}/{rootID}/{fileID} getFile // swagger:operation GET "api/v1/files/teams/{teamID}/{boardID}/{filename} getFile
// //
// Returns the contents of an uploaded file // Returns the contents of an uploaded file
// //
@ -1835,19 +1835,19 @@ func (a *API) handleServeFile(w http.ResponseWriter, r *http.Request) {
// - image/png // - image/png
// - image/gif // - image/gif
// parameters: // parameters:
// - name: teamID
// in: path
// description: Team ID
// required: true
// type: string
// - name: boardID // - name: boardID
// in: path // in: path
// description: Board ID // description: Board ID
// required: true // required: true
// type: string // type: string
// - name: rootID // - name: filename
// in: path // in: path
// description: ID of the root block // description: name of the file
// required: true
// type: string
// - name: fileID
// in: path
// description: ID of the file
// required: true // required: true
// type: string // type: string
// security: // security:
@ -1865,7 +1865,8 @@ func (a *API) handleServeFile(w http.ResponseWriter, r *http.Request) {
filename := vars["filename"] filename := vars["filename"]
userID := getUserID(r) userID := getUserID(r)
if !a.permissions.HasPermissionToBoard(userID, boardID, model.PermissionViewBoard) { hasValidReadToken := a.hasValidReadTokenForBoard(r, boardID)
if !hasValidReadToken && !a.permissions.HasPermissionToBoard(userID, boardID, model.PermissionViewBoard) {
a.errorResponse(w, r.URL.Path, http.StatusForbidden, "", PermissionError{"access denied to board"}) a.errorResponse(w, r.URL.Path, http.StatusForbidden, "", PermissionError{"access denied to board"})
return return
} }