From 3b4895b1b0d2ccd4d17f5e66915e0004bf76f13c Mon Sep 17 00:00:00 2001
From: advplyr <advplyr@protonmail.com>
Date: Tue, 15 Sep 2026 16:12:26 -0500
Subject: [PATCH] Update author middleware check user can access library

---
 server/controllers/AuthorController.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/server/controllers/AuthorController.js b/server/controllers/AuthorController.js
index 8c2e80aec..85af70df5 100644
--- a/server/controllers/AuthorController.js
+++ b/server/controllers/AuthorController.js
@@ -427,6 +427,7 @@ class AuthorController {
   async middleware(req, res, next) {
     const author = await Database.authorModel.findByPk(req.params.id)
     if (!author) return res.sendStatus(404)
+    if (!req.user.checkCanAccessLibrary(author.libraryId)) return res.sendStatus(404)
 
     if (req.method == 'DELETE' && !req.user.canDelete) {
       Logger.warn(`[AuthorController] User "${req.user.username}" attempted to delete without permission`)