Hotfix : mailing edit

Badsender-com · Apr 15, 2021 · 8d4cde8 · 8d4cde8
1 parent 4156f07
commit 8d4cde8
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 25 deletions.
diff --git a/packages/server/mailing/mailing.controller.js b/packages/server/mailing/mailing.controller.js
@@ -15,6 +15,8 @@ const fileManager = require('../common/file-manage.service.js');
 const modelsUtils = require('../utils/model.js');
 
 const mailingService = require('./mailing.service.js');
+const folderService = require('../folder/folder.service.js');
+const workspaceService = require('../workspace/workspace.service.js');
 
 module.exports = {
  list: asyncHandler(list),
@@ -312,7 +314,25 @@ async function updateMosaico(req, res) {
  const mailing = await Mailings.findOne(query);
 
  if (!mailing) {
- throw new createError.NotFound();
+ throw new createError.NotFound(ERROR_CODES.MAILING_NOT_FOUND);
+ }
+
+ if (!user.isAdmin) {
+ const { _workspace, _parentFolder } = mailing;
+
+ let hasAccess;
+
+ if (_parentFolder) {
+ hasAccess = await folderService.hasAccess(_parentFolder, user);
+ }
+
+ if (_workspace) {
+ hasAccess = await workspaceService.hasAccess(user, _workspace);
+ }
+
+ if (!hasAccess) {
+ throw new createError.Forbidden(ERROR_CODES.FORBIDDEN_RESOURCE_OR_ACTION);
+ }
  }
 
  mailing.data = req.body.data || mailing.data;

diff --git a/packages/server/mailing/mosaico-editor.controller.js b/packages/server/mailing/mosaico-editor.controller.js
@@ -1,17 +1,12 @@
 'use strict';
 
 const asyncHandler = require('express-async-handler');
-const { NotFound } = require('http-errors');
 
 const config = require('../node.config.js');
 const simpleI18n = require('../helpers/server-simple-i18n.js');
 const brandColors = require('../helpers/brand-colors.js');
 const modelsUtils = require('../utils/model.js');
-const mailingService = require('../mailing/mailing.service.js');
-const workspaceService = require('../workspace/workspace.service.js');
-const folderService = require('../folder/folder.service.js');
 const { Mailings } = require('../common/models.common.js');
-const ERROR_CODES = require('../constant/error-codes.js');
 
 module.exports = {
  exposeHelpersToPug: exposeHelpersToPug,
@@ -39,25 +34,6 @@ async function render(req, res) {
  user,
  } = req;
 
- const mailing = await mailingService.findOne(mailingId);
-
- const { _workspace, _parentFolder } = mailing;
-
- let hasAccess;
-
- if (_parentFolder) {
- hasAccess = await folderService.hasAccess(_parentFolder, user);
- }
-
- if (_workspace) {
- hasAccess = await workspaceService.hasAccess(user, _workspace);
- }
-
- if (!hasAccess) {
- res.redirect('/404');
- throw new NotFound(ERROR_CODES.MAILING_NOT_FOUND);
- }
-
  const query = modelsUtils.addGroupFilter(req.user, { _id: mailingId });
  const mailingForMosaico = await Mailings.findOneForMosaico(
  query,