++Strette di Mano

2023-01-08 02:17:01 +01:00
parent d1135f1151
commit 399153f477
7 changed files with 102 additions and 46 deletions
--- a/src/server/router/users_router.js
+++ b/src/server/router/users_router.js
@@ -684,7 +684,12 @@ router.post('/friends/cmd', authenticate, async (req, res) => {

  if (!User.isAdmin(req.user.perm) || !User.isManager(req.user.perm)) {
    // If without permissions, exit
-    if (usernameOrig !== usernameLogged) {
+    if ((usernameOrig !== usernameLogged) && (
+      (usernameDest !== usernameLogged) &&
+      ((cmd === shared_consts.FRIENDSCMD.SETFRIEND) ||
+      (cmd === shared_consts.FRIENDSCMD.SETHANDSHAKE))
+      
+    )) {
      return res.status(404).
        send({ code: server_constants.RIS_CODE_ERR_UNAUTHORIZED, msg: '' });
    }