codeninjasllc/codecombat
1
0
Fork 0
mirror of https://github.com/codeninjasllc/codecombat.git synced 2025-04-01 15:50:11 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fixed . Removed permissions check on old versions of document for version history, because we're not selecting any sensitive fields anyway.

Browse source
This commit is contained in:
Nick Winter 2014-04-19 17:52:17 -07:00
parent f281aa8e2d
commit 05dfa21a93
1 changed files with 1 additions and 3 deletions

4
server/commons/Handler.coffee
View file

@ -104,7 +104,7 @@ module.exports = class Handler
query = { 'target.original': mongoose.Types.ObjectId(id), status: req.query.status or 'pending' }
Patch.find(query).sort('-created').exec (err, patches) =>
return @sendDatabaseError(res, err) if err
patches = (patch.toObject() for patch in patches)
patches = (patch.toObject() for patch in patches)
@sendSuccess(res, patches)
setWatching: (req, res, id) ->
@ -168,8 +168,6 @@ module.exports = class Handler
aggregate = $match: query
@modelClass.aggregate(aggregate).project(selectString).limit(FETCH_LIMIT).sort(sort).exec (err, results) =>
return @sendDatabaseError(res, err) if err
for doc in results
return @sendUnauthorizedError(res) unless @hasAccessToDocument(req, doc)
res.send(results)
res.end()