Merge pull request #306 from openstad/bugfix/deleting-article-with-re…

…source-btn Added auth.useReqUser to route delete on article
openstad · Jun 12, 2023 · b067e05 · b067e05 · github-actions · Jun 12, 2023
2 parents 456a875 + 66b9746
commit b067e05
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/src/routes/api/article.js b/src/routes/api/article.js
@@ -257,9 +257,12 @@ router.route('/:articleId(\\d+)')
 
 // delete article
 // ---------
-	.delete(auth.can('Article', 'delete'))
+	.delete(auth.useReqUser)
 	.delete(function(req, res, next) {
-		req.results
+		const article = req.results;
+		if (!(article && article.can && article.can('delete'))) return next(new Error('You cannot delete this article'));
+
+		article
 			.destroy()
 			.then(() => {
 				res.json({ "article": "deleted" });