From 2d96163b76d4f5fb014e75711443dce8ed956344 Mon Sep 17 00:00:00 2001 From: Chi Vinh Le Date: Wed, 20 Sep 2017 04:35:14 +0700 Subject: [PATCH] Disallow querying for all comments unpriviledgly --- graph/loaders/comments.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/graph/loaders/comments.js b/graph/loaders/comments.js index 2eb0811a6..d79b5dc74 100644 --- a/graph/loaders/comments.js +++ b/graph/loaders/comments.js @@ -94,7 +94,7 @@ const getCommentCountByQuery = (context, {ids, statuses, asset_id, parent_id, au // If user queries for statuses other than NONE and/or ACCEPTED statuses, it needs // special priviledges. if ( - statuses && statuses.some((status) => !['NONE', 'ACCEPTED'].includes(status)) && + !statuses || statuses.some((status) => !['NONE', 'ACCEPTED'].includes(status)) && (context.user == null || !context.user.can(SEARCH_NON_NULL_OR_ACCEPTED_COMMENTS)) ) { return null; @@ -291,7 +291,7 @@ const getCommentsByQuery = async (ctx, {ids, statuses, asset_id, parent_id, auth // If user queries for statuses other than NONE and/or ACCEPTED statuses, it needs // special priviledges. if ( - statuses && statuses.some((status) => !['NONE', 'ACCEPTED'].includes(status)) && + !statuses || statuses.some((status) => !['NONE', 'ACCEPTED'].includes(status)) && (ctx.user == null || !ctx.user.can(SEARCH_NON_NULL_OR_ACCEPTED_COMMENTS)) ) { return null;