fix: is user doesnt have view:users privilege

dont redirect uid/1 to userslug
NodeBB · Apr 12, 2024 · 14f5774 · 14f5774
1 parent 6816e39
commit 14f5774
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 3 deletions.
diff --git a/src/middleware/user.js b/src/middleware/user.js
@@ -203,8 +203,12 @@ module.exports = function (middleware) {
 		if (uid <= 0) {
 			return next();
 		}
-		const userslug = await user.getUserField(uid, 'userslug');
-		if (!userslug) {
+		const [canView, userslug] = await Promise.all([
+			privileges.global.can('view:users', req.uid),
+			user.getUserField(uid, 'userslug'),
+		]);
+
+		if (!userslug || (!canView && req.uid !== uid)) {
 			return next();
 		}
 		const path = req.url.replace(/^\/api/, '')

diff --git a/src/routes/user.js b/src/routes/user.js
@@ -5,7 +5,11 @@ const helpers = require('./helpers');
 const { setupPageRoute } = helpers;
 
 module.exports = function (app, name, middleware, controllers) {
-	const middlewares = [middleware.exposeUid, middleware.canViewUsers, middleware.buildAccountData];
+	const middlewares = [
+		middleware.exposeUid,
+		middleware.canViewUsers,
+		middleware.buildAccountData,
+	];
 	const accountMiddlewares = [
 		...middlewares,
 		middleware.ensureLoggedIn,