gaschz/trilium
1
0
Fork 0
mirror of https://github.com/zadam/trilium.git synced 2025-06-06 18:08:33 +02:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

auth exception for images in electron

Browse Source
This commit is contained in:
azivner 2018-01-07 09:59:05 -05:00
parent 743d72a0c3
commit 8bc2a21d80
2 changed files with 18 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
routes/api/image.js
View File

@ -16,7 +16,7 @@ const imageType = require('image-type');
const sanitizeFilename = require('sanitize-filename'); const sanitizeFilename = require('sanitize-filename');
const wrap = require('express-promise-wrap').wrap; const wrap = require('express-promise-wrap').wrap;
router.get('/:imageId/:filename', auth.checkApiAuth, wrap(async (req, res, next) => { router.get('/:imageId/:filename', auth.checkApiAuthOrElectron, wrap(async (req, res, next) => {
const image = await sql.getFirst("SELECT * FROM images WHERE image_id = ?", [req.params.imageId]); const image = await sql.getFirst("SELECT * FROM images WHERE image_id = ?", [req.params.imageId]);
if (!image) { if (!image) {
@ -28,7 +28,7 @@ router.get('/:imageId/:filename', auth.checkApiAuth, wrap(async (req, res, next)
res.send(image.data); res.send(image.data);
})); }));
router.post('', auth.checkApiAuth, multer.single('upload'), wrap(async (req, res, next) => { router.post('', auth.checkApiAuthOrElectron, multer.single('upload'), wrap(async (req, res, next) => {
const sourceId = req.headers.source_id; const sourceId = req.headers.source_id;
const noteId = req.query.noteId; const noteId = req.query.noteId;
const file = req.file; const file = req.file;

17
services/auth.js
View File

@ -28,6 +28,20 @@ async function checkAuthForMigrationPage(req, res, next) {
} }
} }
// for electron things which need network stuff
// currently we're doing that for file upload because handling form data seems to be difficult
async function checkApiAuthOrElectron(req, res, next) {
if (!req.session.loggedIn && !utils.isElectron()) {
res.status(401).send("Not authorized");
}
else if (await sql.isDbUpToDate()) {
next();
}
else {
res.status(409).send("Mismatched app versions"); // need better response than that
}
}
async function checkApiAuth(req, res, next) { async function checkApiAuth(req, res, next) {
if (!req.session.loggedIn) { if (!req.session.loggedIn) {
res.status(401).send("Not authorized"); res.status(401).send("Not authorized");
@ -63,5 +77,6 @@ module.exports = {
checkAuthForMigrationPage, checkAuthForMigrationPage,
checkApiAuth, checkApiAuth,
checkApiAuthForMigrationPage, checkApiAuthForMigrationPage,
checkAppNotInitialized checkAppNotInitialized,
checkApiAuthOrElectron
}; };