satori/kana
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

防止循环挂载

Browse Source
This commit is contained in:
satori 2022-02-08 04:39:51 +08:00
parent 5b5d293952
commit 990f1b09f3
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
index.js
View File

@ -290,6 +290,9 @@ const object_create = async function (req, res) {
function object_patch(req, res, next) { function object_patch(req, res, next) {
return db(req.params.name).findOne({ _id: req.params._id }, function (err, doc) { return db(req.params.name).findOne({ _id: req.params._id }, function (err, doc) {
if (!doc) return res.status(404).send('目标对象不存在') if (!doc) return res.status(404).send('目标对象不存在')
if (typeof (req.body.attach) !== "undefined") return res.status(403).send("无权限修改挂载目标")
if (typeof (req.body.aid) !== "undefined") return res.status(403).send("无权限修改挂载目标")
// 如果是 user 做一些特殊处理 // 如果是 user 做一些特殊处理
if (req.params.name === 'user') { if (req.params.name === 'user') {
if (req.session.account.gid !== 1) { if (req.session.account.gid !== 1) {