From 138f5a4517b7035597a4622a0dc293b6dec7a372 Mon Sep 17 00:00:00 2001 From: Alex Gleason Date: Mon, 27 Dec 2021 17:18:26 -0600 Subject: [PATCH] EnsureStaffPrivilegedPlug: don't let non-moderators through --- lib/pleroma/web/plugs/ensure_staff_privileged_plug.ex | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/lib/pleroma/web/plugs/ensure_staff_privileged_plug.ex b/lib/pleroma/web/plugs/ensure_staff_privileged_plug.ex index fe0a11dec..c6ed45635 100644 --- a/lib/pleroma/web/plugs/ensure_staff_privileged_plug.ex +++ b/lib/pleroma/web/plugs/ensure_staff_privileged_plug.ex @@ -4,9 +4,8 @@ defmodule Pleroma.Web.Plugs.EnsureStaffPrivilegedPlug do @moduledoc """ - Ensures if staff are privileged enough to do certain tasks + Ensures staff are privileged enough to do certain tasks. """ - import Pleroma.Web.TranslationHelpers import Plug.Conn @@ -19,7 +18,7 @@ defmodule Pleroma.Web.Plugs.EnsureStaffPrivilegedPlug do def call(%{assigns: %{user: %User{is_admin: true}}} = conn, _), do: conn - def call(conn, _) do + def call(%{assigns: %{user: %User{is_moderator: true}}} = conn, _) do if Config.get!([:instance, :privileged_staff]) do conn else @@ -28,4 +27,10 @@ defmodule Pleroma.Web.Plugs.EnsureStaffPrivilegedPlug do |> halt() end end + + def call(conn, _) do + conn + |> render_error(:forbidden, "User is not a staff member.") + |> halt() + end end -- 2.45.2