Fixed access control checking.
Ylian Saint-Hilaire committed
Jan 25, 2021 at 00:22 UTC
bb3cba35c378d34b5518f2a42cbbd11458cf5f7e
1 file changed
+4
-4
webserver.js
+4
-4
@@ -6010,13 +6010,13 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
6010
if (i.startsWith('mesh/')) {
6011
// Grant access to a device group thru a direct link
6012
const m = obj.meshes[i];
6013
- if ((m) && (m.deleted == null) && ((rights == null) || ((m.rights & rights) != 0))) {
6013
+ if ((m) && (m.deleted == null) && ((rights == null) || ((user.links[i].rights & rights) != 0))) {
6014
if (r.indexOf(m) == -1) { r.push(m); }
6015
}
6016
} else if (i.startsWith('ugrp/')) {
6017
// Grant access to a device group thru a user group
6018
const g = obj.userGroups[i];
6019
- if (g && (g.links != null) && ((rights == null) || ((g.rights & rights) != 0))) {
6019
+ if (g && (g.links != null) && ((rights == null) || ((user.links[i].rights & rights) != 0))) {
6020
for (var j in g.links) {
6021
if (j.startsWith('mesh/')) {
6022
const m = obj.meshes[j];
@@ -6047,13 +6047,13 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
6047
if (i.startsWith('mesh/')) {
6048
// Grant access to a device group thru a direct link
6049
const m = obj.meshes[i];
6050
- if ((m) && (m.deleted == null) && ((rights == null) || ((m.rights & rights) != 0))) {
6050
+ if ((m) && (m.deleted == null) && ((rights == null) || ((user.links[i].rights & rights) != 0))) {
6051
if (r.indexOf(m._id) == -1) { r.push(m._id); }
6052
}
6053
} else if (i.startsWith('ugrp/')) {
6054
// Grant access to a device group thru a user group
6055
const g = obj.userGroups[i];
6056
- if (g && (g.links != null) && ((rights == null) || ((g.rights & rights) != 0))) {
6056
+ if (g && (g.links != null) && ((rights == null) || ((user.links[i].rights & rights) != 0))) {
6057
for (var j in g.links) {
6058
if (j.startsWith('mesh/')) {
6059
const m = obj.meshes[j];