apunkt/mike
1
0
Fork 0
mirror of https://github.com/willchen96/mike.git synced 2026-06-28 21:49:37 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat: prevent users from sharing projects and reviews with themselves

Browse source
This commit is contained in:
willchen96 2026-05-16 00:05:16 +08:00
parent 9e7046d4aa
commit 87e55d6046
4 changed files with 60 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

6
backend/src/routes/tabular.ts
View file

@ -463,12 +463,18 @@ tabularRouter.patch("/:reviewId", requireAuth, async (req, res) => {
// making the call. Normalize lowercase + dedupe + drop empties.
let sharedWithUpdate: string[] | undefined;
if (Array.isArray(req.body.shared_with)) {
const normalizedUserEmail = userEmail?.trim().toLowerCase();
const seen = new Set<string>();
const cleaned: string[] = [];
for (const raw of req.body.shared_with) {
if (typeof raw !== "string") continue;
const e = raw.trim().toLowerCase();
if (!e || seen.has(e)) continue;
if (normalizedUserEmail && e === normalizedUserEmail) {
return void res.status(400).json({
detail: "You cannot share a tabular review with yourself.",
});
}
seen.add(e);
cleaned.push(e);
}