sij/anything-llm
1
0
Fork 0
mirror of https://github.com/Mintplex-Labs/anything-llm.git synced 2025-04-17 18:18:11 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

prevent manager in multi-user from updatingENV via HTTP ()

Browse source 
* prevent manager in multi-user from updatingENV via HTTP

* remove unneeded args
This commit is contained in:
Timothy Carambat 2024-01-11 12:11:45 -08:00 • committed by GitHub
parent 3c859ba303
commit 7200a06ef0
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 8 additions and 0 deletions
server
endpoints
system.js
utils/http
index.js

6
server/endpoints/system.js
View file

@ -283,6 +283,12 @@ function systemEndpoints(app) {
[validatedRequest, flexUserRoleValid],
async (request, response) => {
try {
const user = await userFromSession(request, response);
if (!!user && user.role !== "admin") {
response.sendStatus(401).end();
return;
}
const body = reqBody(request);
const { newValues, error } = updateENV(body);
if (process.env.NODE_ENV === "production") await dumpENV();

2
server/utils/http/index.js
View file

@ -20,6 +20,8 @@ function makeJWT(info = {}, expiry = "30d") {
return JWT.sign(info, process.env.JWT_SECRET, { expiresIn: expiry });
}
// Note: Only valid for finding users in multi-user mode
// as single-user mode with password is not a "user"
async function userFromSession(request, response = null) {
if (!!response && !!response.locals?.user) {
return response.locals.user;