fix: comments.info endpoint not accessible to non-admins

closes #6516
2024-02-09 18:18:14 -05:00
parent 24ce661b7d
commit 329426d09f
3 changed files with 46 additions and 1 deletions
--- a/server/routes/api/comments/comments.ts
+++ b/server/routes/api/comments/comments.ts
@@ -69,6 +69,13 @@ router.post(
    });
    authorize(user, "read", comment);

+    if (comment.documentId) {
+      const document = await Document.findByPk(comment.documentId, {
+        userId: user.id,
+      });
+      authorize(user, "read", document);
+    }
+
    ctx.body = {
      data: presentComment(comment),
      policies: presentPolicies(user, [comment]),