Docker/documize
Docker/documize
1
0
Fork 0
mirror of https://github.com/documize/community.git synced 2025-07-19 21:29:42 +02:00
Code Releases Activity

Exclude draft versions from non-lifecycle users

Browse source 
Only show draft documents to those with lifecycle permissions.

Closes #242
This commit is contained in:
Harvey Kandola 2019-04-15 13:23:41 +01:00
parent 2fffb7869e
commit e10d04d22e
5 changed files with 753 additions and 734 deletions
Download patch file Download diff file Expand all files Collapse all files

24
domain/document/endpoint.go
View file

@ -586,6 +586,12 @@ func (h *Handler) FetchDocumentData(w http.ResponseWriter, r *http.Request) {
return
}
// Check if draft document can been seen by user.
if document.Lifecycle == workflow.LifecycleDraft && !permission.CanViewDrafts(ctx, *h.Store, document.SpaceID) {
response.WriteForbiddenError(w)
return
}
// permissions
perms, err := h.Store.Permission.GetUserSpacePermissions(ctx, document.SpaceID)
if err != nil && err != sql.ErrNoRows {
@ -633,14 +639,26 @@ func (h *Handler) FetchDocumentData(w http.ResponseWriter, r *http.Request) {
// Get version information for this document.
v := []doc.Version{}
if len(document.GroupID) > 0 {
v, err = h.Store.Document.GetVersions(ctx, document.GroupID)
if err != nil && err != sql.ErrNoRows {
// Get versions.
vt, err := h.Store.Document.GetVersions(ctx, document.GroupID)
if err != nil {
response.WriteServerError(w, method, err)
h.Runtime.Log.Error(method, err)
return
}
// What about draft document versions?
if record.DocumentLifecycle {
// We can see and manage document lifecycle so take all versions.
v = vt
} else {
// Only send back LIVE content because user cannot drafts.
for i := range vt {
if vt[i].Lifecycle == workflow.LifecycleLive {
v = append(v, vt[i])
}
}
}
}
// Prepare response.