diff options
| author | Zain Fathoni <zain.fathoni@gmail.com> | 2018-12-08 00:59:22 +0800 |
|---|---|---|
| committer | Zain Fathoni <zain.fathoni@gmail.com> | 2018-12-08 00:59:22 +0800 |
| commit | 85438f81b90481f9d23fe8afae6b3263a6819391 (patch) | |
| tree | 58a45f65d79736b58589b6f2efb9f4ab2cf4c549 /stepped-solutions/53/backend/src/resolvers/Query.js | |
| parent | 44a7fbee19b3dfb2257282ed040ce91907b016d4 (diff) | |
Fix view permission checking in order query
Diffstat (limited to 'stepped-solutions/53/backend/src/resolvers/Query.js')
| -rwxr-xr-x | stepped-solutions/53/backend/src/resolvers/Query.js | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/stepped-solutions/53/backend/src/resolvers/Query.js b/stepped-solutions/53/backend/src/resolvers/Query.js index 8e0f169..b6b8e48 100755 --- a/stepped-solutions/53/backend/src/resolvers/Query.js +++ b/stepped-solutions/53/backend/src/resolvers/Query.js @@ -44,7 +44,7 @@ const Query = { // 3. Check if the have the permissions to see this order const ownsOrder = order.user.id === ctx.request.userId; const hasPermissionToSeeOrder = ctx.request.user.permissions.includes('ADMIN'); - if (!ownsOrder || !hasPermission) { + if (!ownsOrder && !hasPermissionToSeeOrder) { throw new Error('You cant see this buddd'); } // 4. Return the order |