self-hosted/focalboard
1
0
Fork 0
mirror of https://github.com/mattermost/focalboard.git synced 2025-07-12 23:50:27 +02:00
Code Issues Releases Activity

Merge pull request #2702 from mattermost/gh-2678-shared-files

Browse Source 
GH-2678 Update handleServeFile to allow readtoken
This commit is contained in:
Scott Bishel
2022-03-31 16:34:21 -06:00
committed by GitHub
parent d972cac4a1 c098eda254
commit 2d356c696b
1 changed files with 10 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
server/api/api.go
View File

@ -1824,7 +1824,7 @@ func (a *API) handlePostTeamRegenerateSignupToken(w http.ResponseWriter, r *http
// File upload // File upload
func (a *API) handleServeFile(w http.ResponseWriter, r *http.Request) { func (a *API) handleServeFile(w http.ResponseWriter, r *http.Request) {
// swagger:operation GET /boards/{boardID}/{rootID}/{fileID} getFile // swagger:operation GET "api/v1/files/teams/{teamID}/{boardID}/{filename} getFile
// //
// Returns the contents of an uploaded file // Returns the contents of an uploaded file
// //
@ -1835,19 +1835,19 @@ func (a *API) handleServeFile(w http.ResponseWriter, r *http.Request) {
// - image/png // - image/png
// - image/gif // - image/gif
// parameters: // parameters:
// - name: teamID
// in: path
// description: Team ID
// required: true
// type: string
// - name: boardID // - name: boardID
// in: path // in: path
// description: Board ID // description: Board ID
// required: true // required: true
// type: string // type: string
// - name: rootID // - name: filename
// in: path // in: path
// description: ID of the root block // description: name of the file
// required: true
// type: string
// - name: fileID
// in: path
// description: ID of the file
// required: true // required: true
// type: string // type: string
// security: // security:
@ -1865,7 +1865,8 @@ func (a *API) handleServeFile(w http.ResponseWriter, r *http.Request) {
filename := vars["filename"] filename := vars["filename"]
userID := getUserID(r) userID := getUserID(r)
if !a.permissions.HasPermissionToBoard(userID, boardID, model.PermissionViewBoard) { hasValidReadToken := a.hasValidReadTokenForBoard(r, boardID)
if !hasValidReadToken && !a.permissions.HasPermissionToBoard(userID, boardID, model.PermissionViewBoard) {
a.errorResponse(w, r.URL.Path, http.StatusForbidden, "", PermissionError{"access denied to board"}) a.errorResponse(w, r.URL.Path, http.StatusForbidden, "", PermissionError{"access denied to board"})
return return
} }