github/hedgedoc
1
0
Fork 0
mirror of https://github.com/hedgedoc/hedgedoc.git synced 2025-03-25 06:54:30 +00:00
Code Issues Projects Releases Packages Wiki Activity

Check for existing notes on POST and dont override them

Browse source 
Previously one could override notes in FreeURL-mode by sending multiple POST requests to the /new/<alias> endpoint. This commit adds a check for an already existing note with the requested alias and returns a HTTP 409 Conflict error in case that happens.

Signed-off-by: Erik Michelson <opensource@erik.michelson.eu>
This commit is contained in:
Erik Michelson 2021-03-29 23:00:34 +02:00 committed by Erik Michelson
parent 6531ea1a21
commit 124b064252
No known key found for this signature in database
GPG key ID: DB99ADDDC5C0AF82
2 changed files with 17 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
lib/errors.js
View file

@ -20,6 +20,9 @@ module.exports = {
errorBadRequest: function (res) {
responseError(res, '400', 'Bad Request', 'something not right.')
},
errorConflict: function (res) {
responseError(res, '409', 'Conflict', 'This note already exists.')
},
errorTooLong: function (res) {
responseError(res, '413', 'Payload Too Large', 'Shorten your note!')
},

15
lib/web/note/util.js
View file

@ -46,7 +46,7 @@ exports.checkViewPermission = function (req, note) {
}
}
exports.newNote = function (req, res, body) {
exports.newNote = async function (req, res, body) {
let owner = null
const noteId = req.params.noteId ? req.params.noteId : null
if (req.isAuthenticated()) {
@ -60,6 +60,19 @@ exports.newNote = function (req, res, body) {
} else {
return req.method === 'POST' ? errors.errorForbidden(res) : errors.errorNotFound(res)
}
try {
const count = await models.Note.count({
where: {
alias: req.alias
}
})
if (count > 0) {
return errors.errorConflict(res)
}
} catch (err) {
logger.error(err)
return errors.errorInternalError(res)
}
}
models.Note.create({
ownerId: owner,