fix: dont let mods load postqueue for a cid they are not a mod of

NodeBB · Oct 5, 2020 · 7bf6d3b · 7bf6d3b
1 parent 2ea9768
commit 7bf6d3b
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/src/controllers/mods.js b/src/controllers/mods.js
@@ -213,7 +213,9 @@ modsController.postQueue = async function (req, res, next) {
 		categories.buildForSelect(req.uid, 'find', ['disabled', 'link', 'slug']),
 		helpers.getCategoriesByStates(req.uid, cid, null, 'moderate'),
 	]);
-
+	if (!moderatedCids.includes(String(cid)) && !isAdminOrGlobalMod) {
+		return next();
+	}
 	allCategories.forEach((c) => {
 		c.disabledClass = !isAdminOrGlobalMod && !moderatedCids.includes(String(c.cid));
 	});