mirrors/Piped-Backend
1
0
Fork 0
mirror of https://github.com/TeamPiped/Piped-Backend synced 2025-09-06 05:21:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

Don't perform authentication checks in subscribed route. (#201)

Browse Source 
If the sessionId is invalid, false should be returned for subscribed, we make it the client's responsibility to ensure the sessionId is valid.
This commit is contained in:
Kavin 2022-02-24 19:06:38 +00:00 committed by GitHub
parent 014c9533c8
commit b0b651f44d
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 10 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
src/main/java/me/kavin/piped/utils/ResponseHelper.java
View File

@ -703,21 +703,19 @@ public class ResponseHelper {
Session s = DatabaseSessionFactory.createSession(); Session s = DatabaseSessionFactory.createSession();
User user = DatabaseHelper.getUserFromSessionWithSubscribed(s, session); var cb = s.getCriteriaBuilder();
var query = cb.createQuery(Long.class);
if (user != null) { var root = query.from(User.class);
if (user.getSubscribed().contains(channelId)) { query.select(cb.count(root))
s.close(); .where(cb.and(
return Constants.mapper.writeValueAsBytes(new SubscribeStatusResponse(true)); cb.equal(root.get("sessionId"), session),
} cb.isMember(channelId, root.get("subscribed_ids"))
s.close(); ));
return Constants.mapper.writeValueAsBytes(new SubscribeStatusResponse(false)); var subscribed = s.createQuery(query).getSingleResult() > 0;
}
s.close(); s.close();
return Constants.mapper.writeValueAsBytes(new AuthenticationFailureResponse()); return Constants.mapper.writeValueAsBytes(new SubscribeStatusResponse(subscribed));
} }
public static byte[] feedResponse(String session) public static byte[] feedResponse(String session)