Restrict to delete somebody else's story

c3rooks · Jun 20, 2020 · d2fea33 · d2fea33
1 parent 57f25bb
commit d2fea33
Showing 1 changed file with 12 additions and 2 deletions.
diff --git a/routes/stories.js b/routes/stories.js
@@ -115,8 +115,18 @@ router.put('/:id', ensureAuth, async (req, res) => {
 // @route DELETE /stories/:id
 router.delete('/:id', ensureAuth, async (req, res) => {
  try {
- await Story.remove({ _id: req.params.id })
- res.redirect('/dashboard')
+ let story = await Story.findById(req.params.id).lean()
+
+ if (!story) {
+ return res.render('error/404')
+ }
+
+ if (story.user != req.user.id) {
+ res.redirect('/stories')
+ } else {
+ await Story.remove({ _id: req.params.id })
+ res.redirect('/dashboard')
+ }
  } catch (err) {
  console.error(err)
  return res.render('error/500')