mirror of
https://github.com/Ocelot-Social-Community/Ocelot-Social.git
synced 2025-12-13 07:46:06 +00:00
fix: send 403 if you try to edit another's post
This also fixes the glitch that you click on "Edit post" and the contribution form is empty.
This commit is contained in:
parent
6c947f782d
commit
7c278d7c7f
@ -10,41 +10,37 @@
|
|||||||
<script>
|
<script>
|
||||||
import HcContributionForm from '~/components/ContributionForm/ContributionForm'
|
import HcContributionForm from '~/components/ContributionForm/ContributionForm'
|
||||||
import PostQuery from '~/graphql/PostQuery'
|
import PostQuery from '~/graphql/PostQuery'
|
||||||
|
import { mapGetters } from 'vuex'
|
||||||
|
|
||||||
export default {
|
export default {
|
||||||
components: {
|
components: {
|
||||||
HcContributionForm,
|
HcContributionForm,
|
||||||
},
|
},
|
||||||
computed: {
|
computed: {
|
||||||
user() {
|
...mapGetters({
|
||||||
return this.$store.getters['auth/user']
|
user: 'auth/user',
|
||||||
|
}),
|
||||||
},
|
},
|
||||||
author() {
|
async asyncData(context) {
|
||||||
return this.contribution ? this.contribution.author : {}
|
const {
|
||||||
|
app,
|
||||||
|
store,
|
||||||
|
error,
|
||||||
|
params: { id },
|
||||||
|
} = context
|
||||||
|
let client = app.apolloProvider.defaultClient
|
||||||
|
const {
|
||||||
|
data: {
|
||||||
|
Post: [contribution],
|
||||||
},
|
},
|
||||||
contribution() {
|
} = await client.query({
|
||||||
return this.Post ? this.Post[0] : {}
|
query: PostQuery(app.$i18n),
|
||||||
},
|
variables: { id },
|
||||||
},
|
})
|
||||||
watch: {
|
if (contribution.author.id !== store.getters['auth/user'].id) {
|
||||||
contribution() {
|
error({ statusCode: 403, message: "You can't edit that!" })
|
||||||
if (this.author.id !== this.user.id) {
|
|
||||||
throw new Error(`You can't edit that!`)
|
|
||||||
}
|
}
|
||||||
},
|
return { contribution }
|
||||||
},
|
|
||||||
apollo: {
|
|
||||||
Post: {
|
|
||||||
query() {
|
|
||||||
return PostQuery(this.$i18n)
|
|
||||||
},
|
|
||||||
variables() {
|
|
||||||
return {
|
|
||||||
id: this.$route.params.id,
|
|
||||||
}
|
|
||||||
},
|
|
||||||
fetchPolicy: 'cache-and-network',
|
|
||||||
},
|
|
||||||
},
|
},
|
||||||
}
|
}
|
||||||
</script>
|
</script>
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user