Weishen/Hydro
2
0 Fork 0
mirror of https://gitcode.com/gh_mirrors/hy/Hydro.git synced 2026-10-20 01:38:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

core: do not allow updating domain owner's permission

Browse Source
This commit is contained in:
undefined committed 2023-05-01 00:58:39 +08:00
1 parent a4100812c5
commit 2f2ef471f7
1 file changed
+3 -1
Download Patch File Download Diff File Expand all files Collapse all files
packages/hydrooj/src/handler/domain.ts
+3 -1
View File
@@ -3,7 +3,7 @@ import { Dictionary } from 'lodash';
import moment from 'moment-timezone'; import moment from 'moment-timezone';
import { Context } from '../context'; import { Context } from '../context';
import { import {
CannotDeleteSystemDomainError, DomainJoinAlreadyMemberError, DomainJoinForbiddenError, CannotDeleteSystemDomainError, DomainJoinAlreadyMemberError, DomainJoinForbiddenError, ForbiddenError,
InvalidJoinInvitationCodeError, OnlyOwnerCanDeleteDomainError, PermissionError, RoleAlreadyExistError, ValidationError, InvalidJoinInvitationCodeError, OnlyOwnerCanDeleteDomainError, PermissionError, RoleAlreadyExistError, ValidationError,
} from '../error'; } from '../error';
import type { DomainDoc } from '../interface'; import type { DomainDoc } from '../interface';
@@ -162,6 +162,7 @@ class DomainUserHandler extends ManageHandler {
@post('uid', Types.Int) @post('uid', Types.Int)
@post('role', Types.Role) @post('role', Types.Role)
async postSetUser(domainId: string, uid: number, role: string) { async postSetUser(domainId: string, uid: number, role: string) {
if (uid === this.domain.owner) throw new ForbiddenError();
await Promise.all([ await Promise.all([
domain.setUserRole(domainId, uid, role), domain.setUserRole(domainId, uid, role),
oplog.log(this, 'domain.setRole', { uid, role }), oplog.log(this, 'domain.setRole', { uid, role }),
@@ -173,6 +174,7 @@ class DomainUserHandler extends ManageHandler {
@param('uid', Types.NumericArray) @param('uid', Types.NumericArray)
@param('role', Types.Role) @param('role', Types.Role)
async postSetUsers(domainId: string, uid: number[], role: string) { async postSetUsers(domainId: string, uid: number[], role: string) {
if (uid.includes(this.domain.owner)) throw new ForbiddenError();
await Promise.all([ await Promise.all([
domain.setUserRole(domainId, uid, role), domain.setUserRole(domainId, uid, role),
oplog.log(this, 'domain.setRole', { uid, role }), oplog.log(this, 'domain.setRole', { uid, role }),