rpdata/api
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

graph2: Fixed inverse permission checks in story mutations.
the build failed
Details

Browse Source
This commit is contained in:
gisle
2018-09-22 15:31:53 +02:00
parent 0e0d802a32
commit cd1f122502
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
graph2/queries/story.go
+4 -4
View File
@@ -68,7 +68,7 @@ func (r *mutationResolver) AddStoryTag(ctx context.Context, input input.StoryTag
return models.Story{}, errors.New("Story not found")
}
if token.PermittedUser(story.Author, "member", "story.edit") {
if !token.PermittedUser(story.Author, "member", "story.edit") {
return models.Story{}, errors.New("You are not permitted to edit this story")
}
@@ -83,7 +83,7 @@ func (r *mutationResolver) RemoveStoryTag(ctx context.Context, input input.Story
return models.Story{}, errors.New("Story not found")
}
if token.PermittedUser(story.Author, "member", "story.edit") {
if !token.PermittedUser(story.Author, "member", "story.edit") {
return models.Story{}, errors.New("You are not permitted to edit this story")
}
@@ -98,7 +98,7 @@ func (r *mutationResolver) EditStory(ctx context.Context, input input.StoryEditI
return models.Story{}, errors.New("Story not found")
}
if token.PermittedUser(story.Author, "member", "story.edit") {
if !token.PermittedUser(story.Author, "member", "story.edit") {
return models.Story{}, errors.New("You are not permitted to remove this story")
}
@@ -117,7 +117,7 @@ func (r *mutationResolver) RemoveStory(ctx context.Context, input input.StoryRem
return models.Story{}, errors.New("Story not found")
}
if token.PermittedUser(story.Author, "member", "story.remove") {
if !token.PermittedUser(story.Author, "member", "story.remove") {
return models.Story{}, errors.New("You are not permitted to remove this story")
}