Archives/Athou_commafeed
1
0
Fork 0
mirror of https://github.com/Athou/commafeed.git synced 2026-11-05 03:44:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

prevent users from referencing categories owned by other users

Browse Source
This commit is contained in:
Athou
2026-11-04 08:34:47 +01:00
parent ae707a2602
commit d691095746
5 changed files with 179 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
commafeed-server/src/main/java/com/commafeed/frontend/resource/CategoryREST.java
View File

@@ -39,6 +39,7 @@ import jakarta.validation.Valid;
import jakarta.ws.rs.Consumes;
import jakarta.ws.rs.DefaultValue;
import jakarta.ws.rs.GET;
import jakarta.ws.rs.NotFoundException;
import jakarta.ws.rs.POST;
import jakarta.ws.rs.Path;
import jakarta.ws.rs.Produces;
@@ -333,8 +334,10 @@ public class CategoryREST {
cat.setPosition(0);
String parentId = req.getParentId();
if (parentId != null && !ALL.equals(parentId)) {
FeedCategory parent = new FeedCategory();
parent.setId(Long.valueOf(parentId));
FeedCategory parent = feedCategoryDAO.findById(user, Long.valueOf(parentId));
if (parent == null) {
throw new NotFoundException("parent category not found");
}
cat.setParent(parent);
}
feedCategoryDAO.persist(cat);

8
commafeed-server/src/main/java/com/commafeed/frontend/resource/FeedREST.java
View File

@@ -407,13 +407,17 @@ public class FeedREST {
Preconditions.checkNotNull(req.getUrl());
try {
User user = authenticationContext.getCurrentUser();
FeedCategory category = null;
if (req.getCategoryId() != null && !CategoryREST.ALL.equals(req.getCategoryId())) {
category = feedCategoryDAO.findById(Long.valueOf(req.getCategoryId()));
category = feedCategoryDAO.findById(user, Long.valueOf(req.getCategoryId()));
if (category == null) {
return Response.status(Status.NOT_FOUND).build();
}
}
FeedInfo info = fetchFeedInternal(prependHttp(req.getUrl()));
User user = authenticationContext.getCurrentUser();
long subscriptionId = feedSubscriptionService.subscribe(user, info.getUrl(), req.getTitle(), category, 0);
return Response.ok(subscriptionId).build();
} catch (Exception e) {