1
0
mirror of https://github.com/muety/wakapi.git synced 2023-08-10 21:12:56 +03:00

fix: admin users can't fetch other user data

This commit is contained in:
Asen Mihaylov 2022-06-28 13:01:35 +03:00
parent 099cdaddbc
commit affff0c386

View File

@ -35,7 +35,7 @@ func CheckEffectiveUser(w http.ResponseWriter, r *http.Request, userService serv
return nil, err return nil, err
} }
if authorizedUser == nil || authorizedUser.ID != requestedUser.ID { if authorizedUser == nil || authorizedUser.ID != requestedUser.ID && !authorizedUser.IsAdmin {
err := errors.New(conf.ErrUnauthorized) err := errors.New(conf.ErrUnauthorized)
w.WriteHeader(http.StatusUnauthorized) w.WriteHeader(http.StatusUnauthorized)
w.Write([]byte(err.Error())) w.Write([]byte(err.Error()))