brian/wanderer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

race condition security patch

Browse Source
This commit is contained in:
Christian Beutel
2025-04-18 12:59:17 +02:00
parent 29b8a0352e
commit d8f7a862f6
53 changed files with 240 additions and 222 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
web/src/routes/api/v1/notification/+server.ts
View File

@@ -1,16 +1,15 @@
import type { Notification } from '$lib/models/notification';
import type { UserAnonymous } from '$lib/models/user';
import { pb } from '$lib/pocketbase';
import { Collection, handleError, list } from '$lib/util/api_util';
import { error, json, type RequestEvent } from '@sveltejs/kit';
import { json, type RequestEvent } from '@sveltejs/kit';
export async function GET(event: RequestEvent) {
try {
const r = await list<Notification>(event, Collection.notifications);
for (const notification of r.items) {
const recipient = await pb.collection('users_anonymous').getOne<UserAnonymous>(notification.recipient, { requestKey: null })
const author = await pb.collection('users_anonymous').getOne<UserAnonymous>(notification.author, { requestKey: null })
const recipient = await event.locals.pb.collection('users_anonymous').getOne<UserAnonymous>(notification.recipient, { requestKey: null })
const author = await event.locals.pb.collection('users_anonymous').getOne<UserAnonymous>(notification.author, { requestKey: null })
notification.expand = {
recipient, author
}