From 4997514f0174fa910c809ea6a062ceecf7b2d184 Mon Sep 17 00:00:00 2001 From: wodka Date: Mon, 15 Jul 2019 00:26:37 +0200 Subject: [PATCH] give visitor information only authenticated --- app/routes/forms.server.routes.js | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/app/routes/forms.server.routes.js b/app/routes/forms.server.routes.js index 7d2e3e14..601744a7 100644 --- a/app/routes/forms.server.routes.js +++ b/app/routes/forms.server.routes.js @@ -32,7 +32,7 @@ module.exports = function(app) { app.route('/forms/:formIdFast([a-zA-Z0-9]+)') .post(forms.createSubmission); - + app.route('/forms') .get(auth.isAuthenticatedOrApiKey, forms.list) .post(auth.isAuthenticatedOrApiKey, forms.create); @@ -47,8 +47,9 @@ module.exports = function(app) { .get(auth.isAuthenticatedOrApiKey, forms.hasAuthorization, forms.listSubmissions) .delete(auth.isAuthenticatedOrApiKey, forms.hasAuthorization, forms.deleteSubmissions); - app.route('/forms/:formIdNoMiddleware([a-zA-Z0-9]+)/visitors') - .get(auth.isAuthenticatedOrApiKey, forms.getVisitorData); + app.route('/forms/:formId([a-zA-Z0-9]+)/visitors') + .get(auth.isAuthenticatedOrApiKey, forms.hasAuthorization, forms.getVisitorData); + // Slower formId middleware app.param('formId', forms.formByID);