Merge pull request bradtraversy#10 from rafasfz/master

Added a validation on the single story route
aldoBangun · Sep 1, 2020 · 1381a27 · 1381a27
2 parents efe8ee5 + fd63c8e
commit 1381a27
Showing 1 changed file with 7 additions and 3 deletions.
diff --git a/routes/stories.js b/routes/stories.js
@@ -51,9 +51,13 @@ router.get('/:id', ensureAuth, async (req, res) => {
  return res.render('error/404')
  }
 
- res.render('stories/show', {
- story,
- })
+ if (story.user._id != req.user.id && story.status == 'private') {
+ res.render('error/404')
+ } else {
+ res.render('stories/show', {
+ story,
+ })
+ }
  } catch (err) {
  console.error(err)
  res.render('error/404')