gitea-mirror/zipline
1
0
Fork 0
mirror of https://github.com/diced/zipline.git synced 2025-12-12 07:40:45 -08:00
Code Issues Packages Projects Releases Wiki Activity

fix: #876

Browse Source
This commit is contained in:
diced
2025-09-05 20:59:22 -07:00
parent e2e3edd208
commit 4907f4e450
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/server/routes/api/user/files/[id]/raw.ts
View File

@@ -4,6 +4,7 @@ import { verifyPassword } from '@/lib/crypto';
import { datasource } from '@/lib/datasource'; import { datasource } from '@/lib/datasource';
import { prisma } from '@/lib/db'; import { prisma } from '@/lib/db';
import { log } from '@/lib/logger'; import { log } from '@/lib/logger';
import { canInteract } from '@/lib/role';
import { userMiddleware } from '@/server/middleware/user'; import { userMiddleware } from '@/server/middleware/user';
import fastifyPlugin from 'fastify-plugin'; import fastifyPlugin from 'fastify-plugin';
@@ -44,10 +45,16 @@ export default fastifyPlugin(
const file = await prisma.file.findFirst({ const file = await prisma.file.findFirst({
where: { where: {
id, id,
userId: req.user.id, },
include: {
User: true,
}, },
}); });
if (file && file.userId !== req.user.id) {
if (!canInteract(req.user.role, file.User?.role)) return res.callNotFound();
}
if (file?.deletesAt && file.deletesAt <= new Date()) { if (file?.deletesAt && file.deletesAt <= new Date()) {
try { try {
await datasource.delete(file.name); await datasource.delete(file.name);