summaryrefslogtreecommitdiffstats
path: root/models/cards.js
diff options
context:
space:
mode:
authorhuneau romain <huneau.romain@gmail.com>2017-05-11 12:15:02 +0200
committerhuneau romain <huneau.romain@gmail.com>2017-05-11 12:15:02 +0200
commitb5271e5346cde2563d36c64a300729e27336a86b (patch)
tree98d29cf0deeaeb8a6d337c8dff4b8cf9268541c6 /models/cards.js
parent548172949aaaea054f203d5fdc3286c90c5ae8e1 (diff)
downloadwekan-b5271e5346cde2563d36c64a300729e27336a86b.tar.gz
wekan-b5271e5346cde2563d36c64a300729e27336a86b.tar.bz2
wekan-b5271e5346cde2563d36c64a300729e27336a86b.zip
add token authentication, only admin can use api
Diffstat (limited to 'models/cards.js')
-rw-r--r--models/cards.js4
1 files changed, 4 insertions, 0 deletions
diff --git a/models/cards.js b/models/cards.js
index 2d585825..bbe46b55 100644
--- a/models/cards.js
+++ b/models/cards.js
@@ -373,6 +373,7 @@ if (Meteor.isServer) {
//LISTS REST API
if (Meteor.isServer) {
JsonRoutes.add('GET', '/api/boards/:boardId/lists/:listId/cards', function (req, res, next) {
+ Authentication.checkUserId( req.userId);
const paramBoardId = req.params.boardId;
const paramListId = req.params.listId;
JsonRoutes.sendResult(res, {
@@ -388,6 +389,7 @@ if (Meteor.isServer) {
});
JsonRoutes.add('GET', '/api/boards/:boardId/lists/:listId/cards/:cardId', function (req, res, next) {
+ Authentication.checkUserId( req.userId);
const paramBoardId = req.params.boardId;
const paramListId = req.params.listId;
const paramCardId = req.params.cardId;
@@ -398,6 +400,7 @@ if (Meteor.isServer) {
});
JsonRoutes.add('POST', '/api/boards/:boardId/lists/:listId/cards', function (req, res, next) {
+ Authentication.checkUserId( req.userId);
const paramBoardId = req.params.boardId;
const paramListId = req.params.listId;
const id = Cards.insert({
@@ -418,6 +421,7 @@ if (Meteor.isServer) {
});
JsonRoutes.add('DELETE', '/api/boards/:boardId/lists/:listId/cards/:cardId', function (req, res, next) {
+ Authentication.checkUserId( req.userId);
const paramBoardId = req.params.boardId;
const paramListId = req.params.listId;
const paramCardId = req.params.cardId;