Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: avoid making memos public when disabled #2816

Merged
merged 2 commits into from Jan 22, 2024
Merged

fix: avoid making memos public when disabled #2816

merged 2 commits into from Jan 22, 2024

Conversation

moehanabi
Copy link
Contributor

@moehanabi moehanabi commented Jan 21, 2024

fix #2814

I am not familiar with golang coding, so please make a double check before merge, especially api v1 version.

After this change, changes to the existing public memos would also be banned in api v2. I don't know if it is in line with the original intent of the public memos (I think the target to disable public memos is to prevent users from causually adding/modifying the content displayed on the public pages).

For api v1, enforce normal user to save as private memo if public memos are disabled, just like CreateMemo.

Besides, I wonder whether the api v1 is deprecated and whether it need updating.

Copy link
Collaborator

@boojack boojack left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@boojack boojack merged commit 3a129d5 into usememos:main Jan 22, 2024
5 checks passed
@moehanabi moehanabi deleted the dev1 branch January 22, 2024 14:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

After using the 5172e4d fix, there is still a vulnerability to disable public memos
2 participants