TeamPiped-mirror/Piped-Backend
1
0
Fork 0
mirror of https://github.com/TeamPiped/Piped-Backend.git synced 2024-08-14 23:51:41 +00:00
Code Issues Projects Releases Packages Wiki Activity

Don't perform authentication checks in subscribed route. (#201)

Browse source 
If the sessionId is invalid, false should be returned for subscribed, we make it the client's responsibility to ensure the sessionId is valid.
This commit is contained in:
Kavin 2022-02-24 19:06:38 +00:00 committed by GitHub
parent 014c9533c8
commit b0b651f44d
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 10 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
src/main/java/me/kavin/piped/utils/ResponseHelper.java
View file

@ -703,21 +703,19 @@ public class ResponseHelper {
Session s = DatabaseSessionFactory.createSession();
User user = DatabaseHelper.getUserFromSessionWithSubscribed(s, session);
if (user != null) {
if (user.getSubscribed().contains(channelId)) {
s.close();
return Constants.mapper.writeValueAsBytes(new SubscribeStatusResponse(true));
}
s.close();
return Constants.mapper.writeValueAsBytes(new SubscribeStatusResponse(false));
}
var cb = s.getCriteriaBuilder();
var query = cb.createQuery(Long.class);
var root = query.from(User.class);
query.select(cb.count(root))
.where(cb.and(
cb.equal(root.get("sessionId"), session),
cb.isMember(channelId, root.get("subscribed_ids"))
));
var subscribed = s.createQuery(query).getSingleResult() > 0;
s.close();
return Constants.mapper.writeValueAsBytes(new AuthenticationFailureResponse());
return Constants.mapper.writeValueAsBytes(new SubscribeStatusResponse(subscribed));
}
public static byte[] feedResponse(String session)