only allow "forum" and admins to do stuff

thejh · Dec 30, 2011 · c452405 · c452405
1 parent 69fca55
commit c452405
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/couchdb/app.js b/couchdb/app.js
@@ -10,6 +10,10 @@ var ddoc =
 
 module.exports = ddoc
 
+ddoc.validate_doc_update = function(newdoc, olddoc, userCtx, secobj) {
+  if (userCtx.name !== 'forum' && userCtx.roles.indexOf('_admin') === -1) throw {forbidden: 'you must be logged in as "forum" or an admin'}
+}
+
 ddoc.views.threadPosts =
 { map: function(doc) {
     if (doc._id.slice(0, 5) === 'post:') {