Enabled history get permission using cascade verification (#462)

switcherapi · Nov 2, 2023 · 53bf66d · 53bf66d
1 parent f2a5ec5
commit 53bf66d
Show file tree

Hide file tree

Showing 4 changed files with 4 additions and 4 deletions.
diff --git a/src/routers/config-strategy.js b/src/routers/config-strategy.js
@@ -80,7 +80,7 @@ router.get('/configstrategy/history/:id', auth, [
         const query = 'oldValue newValue updatedBy date -_id';
         const history = await getHistory(query, configStrategy.domain, configStrategy._id, req.query);
 
-        await verifyOwnership(req.admin, configStrategy, configStrategy.domain, ActionTypes.READ, RouterTypes.STRATEGY);
+        await verifyOwnership(req.admin, configStrategy, configStrategy.domain, ActionTypes.READ, RouterTypes.STRATEGY, true);
 
         res.send(history);
     } catch (e) {

diff --git a/src/routers/config.js b/src/routers/config.js
@@ -95,7 +95,7 @@ router.get('/config/history/:id', auth, [
         const query = 'oldValue newValue updatedBy date -_id';
         const history = await getHistory(query, config.domain, config._id, req.query);
 
-        await verifyOwnership(req.admin, config, config.domain, ActionTypes.READ, RouterTypes.CONFIG);
+        await verifyOwnership(req.admin, config, config.domain, ActionTypes.READ, RouterTypes.CONFIG, true);
 
         res.send(history);
     } catch (e) {

diff --git a/src/routers/domain.js b/src/routers/domain.js
@@ -79,7 +79,7 @@ router.get('/domain/history/:id', auth, [
         const query = 'oldValue newValue updatedBy date -_id';
         const history = await getHistory(query, domain._id, domain._id, req.query);
 
-        await verifyOwnership(req.admin, domain, domain._id, ActionTypes.READ, RouterTypes.DOMAIN);
+        await verifyOwnership(req.admin, domain, domain._id, ActionTypes.READ, RouterTypes.DOMAIN, true);
 
         res.send(history);
     } catch (e) {

diff --git a/src/routers/group-config.js b/src/routers/group-config.js
@@ -73,7 +73,7 @@ router.get('/groupconfig/history/:id', auth, [
         const query = 'oldValue newValue updatedBy date -_id';
         const history = await getHistory(query, groupconfig.domain, groupconfig._id, req.query);
 
-        await verifyOwnership(req.admin, groupconfig, groupconfig.domain, ActionTypes.READ, RouterTypes.GROUP);
+        await verifyOwnership(req.admin, groupconfig, groupconfig.domain, ActionTypes.READ, RouterTypes.GROUP, true);
 
         res.send(history);
     } catch (e) {