3pp-mirror/penpot
1
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2025-05-19 22:06:10 +02:00
Code Issues Projects Releases Packages Wiki Activity

🐛 Set proper permission check on retrieving team users.

Browse source
This commit is contained in:
Andrey Antukh 2021-01-19 12:53:31 +01:00 • committed by Alonso Torres
parent 4fbd2e6caa
commit 15edabc977
2 changed files with 3 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
backend/src/app/rpc/queries/teams.clj
View file

@ -147,10 +147,10 @@
(with-open [conn (db/open pool)]
(if team-id
(do
(check-edition-permissions! conn profile-id team-id)
(check-read-permissions! conn profile-id team-id)
(retrieve-users conn team-id))
(let [{team-id :id} (retrieve-team-for-file conn file-id)]
(check-edition-permissions! conn profile-id team-id)
(check-read-permissions! conn profile-id team-id)
(retrieve-users conn team-id)))))
;; This is a similar query to team members but can contain more data