Added missing privilege check

OpenMarshal · May 22, 2017 · 3cfdbea · 3cfdbea
1 parent 8b5e8c8
commit 3cfdbea
Show file tree

Hide file tree

Showing 2 changed files with 36 additions and 32 deletions.
diff --git a/lib/server/commands/Get.js b/lib/server/commands/Get.js
@@ -8,21 +8,23 @@ function default_1(arg, callback) {
             callback();
             return;
         }
-        r.read(function (e, c) {
-            if (e)
-                arg.setCode(WebDAVRequest_1.HTTPCodes.MethodNotAllowed);
-            else {
-                arg.setCode(WebDAVRequest_1.HTTPCodes.OK);
-                var content = c;
-                if (c === undefined || c === null)
-                    content = new Buffer(0);
-                else if (c.constructor === Boolean || c.constructor === Number)
-                    content = c.toString();
-                else
-                    content = c;
-                arg.response.write(content);
-            }
-            callback();
+        arg.requirePrivilege(['canRead'], r, function () {
+            r.read(function (e, c) {
+                if (e)
+                    arg.setCode(WebDAVRequest_1.HTTPCodes.MethodNotAllowed);
+                else {
+                    arg.setCode(WebDAVRequest_1.HTTPCodes.OK);
+                    var content = c;
+                    if (c === undefined || c === null)
+                        content = new Buffer(0);
+                    else if (c.constructor === Boolean || c.constructor === Number)
+                        content = c.toString();
+                    else
+                        content = c;
+                    arg.response.write(content);
+                }
+                callback();
+            });
         });
     });
 }

diff --git a/src/server/commands/Get.ts b/src/server/commands/Get.ts
@@ -11,24 +11,26 @@ export default function(arg : MethodCallArgs, callback)
             return;
         }
 
-        r.read((e, c) => {
-            if(e)
-                arg.setCode(HTTPCodes.MethodNotAllowed)
-            else
-            {
-                arg.setCode(HTTPCodes.OK);
-
-                let content : any = c;
-                if(c === undefined || c === null)
-                    content = new Buffer(0);
-                else if(c.constructor === Boolean || c.constructor === Number)
-                    content = c.toString()
+        arg.requirePrivilege([ 'canRead' ], r, () => {
+            r.read((e, c) => {
+                if(e)
+                    arg.setCode(HTTPCodes.MethodNotAllowed);
                 else
-                    content = c;
-
-                arg.response.write(content);
-            }
-            callback();
+                {
+                    arg.setCode(HTTPCodes.OK);
+
+                    let content : any = c;
+                    if(c === undefined || c === null)
+                        content = new Buffer(0);
+                    else if(c.constructor === Boolean || c.constructor === Number)
+                        content = c.toString()
+                    else
+                        content = c;
+
+                    arg.response.write(content);
+                }
+                callback();
+            })
         })
     })
 }