return errorForbidden when anonymous user tries to create freeUrl pad (closes #1499)

ldruschk · ldruschk · commit bcd92f500f1b · 2020-04-29T22:42:56.000+02:00
Signed-off-by: Lucas Druschke &lt;ldruschk@posteo.de&gt;
diff --git a/lib/note/index.js b/lib/note/index.js
@@ -61,6 +61,8 @@ async function showNote (req, res) {
     // if allow free url enable, auto create note
     if (!config.allowFreeURL || config.forbiddenNoteIDs.includes(noteId)) {
       return errorNotFound(req, res)
+    } else if (!config.allowAnonymous && !userId) {
+      return errorForbidden(req, res)
     }
     note = await createNote(userId, noteId)
   }

Original file line number	Diff line number	Diff line change
`@@ -61,6 +61,8 @@ async function showNote (req, res) {`
`61`	`61`	`// if allow free url enable, auto create note`
`62`	`62`	`if (!config.allowFreeURL \|\| config.forbiddenNoteIDs.includes(noteId)) {`
`63`	`63`	`return errorNotFound(req, res)`
	`64`	`+ } else if (!config.allowAnonymous && !userId) {`
	`65`	`+ return errorForbidden(req, res)`
`64`	`66`	`}`
`65`	`67`	`note = await createNote(userId, noteId)`
`66`	`68`	`}`