starred/audiobookshelf
1
0 Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-11-13 12:23:34 +01:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

Update author middleware check user can access library

Browse Source
This commit is contained in:
advplyr committed 2026-09-15 16:12:26 -05:00
1 parent a06639886b
commit 3b4895b1b0
1 file changed
+1
Download Patch File Download Diff File Expand all files Collapse all files
server/controllers/AuthorController.js
+1
View File
@@ -427,6 +427,7 @@ class AuthorController {
async middleware(req, res, next) { async middleware(req, res, next) {
const author = await Database.authorModel.findByPk(req.params.id) const author = await Database.authorModel.findByPk(req.params.id)
if (!author) return res.sendStatus(404) if (!author) return res.sendStatus(404)
if (!req.user.checkCanAccessLibrary(author.libraryId)) return res.sendStatus(404)
if (req.method == 'DELETE' && !req.user.canDelete) { if (req.method == 'DELETE' && !req.user.canDelete) {
Logger.warn(`[AuthorController] User "${req.user.username}" attempted to delete without permission`) Logger.warn(`[AuthorController] User "${req.user.username}" attempted to delete without permission`)