alois/Verso
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): restrict publish-presentation routes to project owners
Build and Deploy Verso / deploy (push) Successful in 10m54s
Details

Browse Source 
Read-only collaborators and token-link users could publish, unpublish,
and rotate presentation share tokens. Change all three write endpoints
from ensureUserCanReadProject to ensureUserCanAdminProject so only the
project owner can perform these actions.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
claude
2026-06-19 10:17:24 +00:00
parent 1814cba458
commit a796577199
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/web/app/src/router.mjs
+3 -3
View File
@@ -695,17 +695,17 @@ async function initialize(webRouter, privateApiRouter, publicApiRouter) {
) )
webRouter.post( webRouter.post(
'/project/:Project_id/publish-presentation', '/project/:Project_id/publish-presentation',
AuthorizationMiddleware.ensureUserCanReadProject, AuthorizationMiddleware.ensureUserCanAdminProject,
PublishedPresentationController.publish PublishedPresentationController.publish
) )
webRouter.post( webRouter.post(
'/project/:Project_id/publish-presentation/regenerate', '/project/:Project_id/publish-presentation/regenerate',
AuthorizationMiddleware.ensureUserCanReadProject, AuthorizationMiddleware.ensureUserCanAdminProject,
PublishedPresentationController.regenerate PublishedPresentationController.regenerate
) )
webRouter.delete( webRouter.delete(
'/project/:Project_id/publish-presentation', '/project/:Project_id/publish-presentation',
AuthorizationMiddleware.ensureUserCanReadProject, AuthorizationMiddleware.ensureUserCanAdminProject,
PublishedPresentationController.unpublish PublishedPresentationController.unpublish
) )
// On-demand export of a RevealJS deck (download menu): html | pdf. // On-demand export of a RevealJS deck (download menu): html | pdf.