Fix for https://huntr.dev/bounties/7-Mailtrain-org/mailtrain/

Mailtrain-org · Jun 6, 2021 · 91cb4ba · 91cb4ba
1 parent 9450e77
commit 91cb4ba
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 4 deletions.
diff --git a/client/src/shares/Share.js b/client/src/shares/Share.js
@@ -103,10 +103,10 @@ export default class Share extends Component {
             actions: data => {
                 const actions = [];
                 const autoGenerated = data[4];
+                const userId = data[3];
 
-                if (!autoGenerated) {
+                if (!autoGenerated && mailtrainConfig.user.id !== userId) {
                     const username = data[0];
-                    const userId = data[3];
 
                     tableAddRestActionButton(
                         actions,

diff --git a/server/models/shares.js b/server/models/shares.js
@@ -130,7 +130,7 @@ async function assign(context, entityTypeId, entityId, userId, role) {
         await tx(entityType.permissionsTable).where({user: userId, entity: entityId}).del();
         if (entityTypeId === 'namespace') {
             await rebuildPermissionsTx(tx, {userId});
-        } else if (role) {
+        } else {
             await rebuildPermissionsTx(tx, { entityTypeId, entityId, userId });
         }
     });
@@ -293,7 +293,6 @@ async function rebuildPermissionsTx(tx, restriction) {
         }
     }
 
-
     // This reads direct shares from DB, joins each with the permissions from namespaces and stores the permissions into DB
     for (const entityTypeId in restrictedEntityTypes) {
         const entityType = restrictedEntityTypes[entityTypeId];