nodebb-plugin-session-sharing 8.0.0 → 8.0.1

package/library.js

@@ -93,19 +93,27 @@ plugin.appendConfig = async (config) => {
 SocketPlugins.sessionSharing = {};
 
 SocketPlugins.sessionSharing.showUserIds = async (socket, data) => {
-	// Retrieve the hash and find matches
-	const { uids } = data;
-
-	if (!uids.length) {
-		throw new Error('no-uids-supplied');
+	if (!socket.uid || !data || !Array.isArray(data.uids)) {
+		throw new Error('[[error:invalid-data]]');
+	}
+	const isAdmin = await user.isAdministrator(socket.uid);
+	if (!isAdmin) {
+		throw new Error('[[error:no-privileges]]');
 	}
 
 	return Promise.all(
-		uids.map(async uid => db.getSortedSetRangeByScore(plugin.settings.name + ':uid', 0, -1, uid, uid))
+		data.uids.map(uid => db.getSortedSetRangeByScore(`${plugin.settings.name}:uid`, 0, -1, uid, uid))
 	);
 };
 
 SocketPlugins.sessionSharing.findUserByRemoteId = async (socket, data) => {
+	if (!socket.uid || !data || !Array.isArray(data.uids)) {
+		throw new Error('[[error:invalid-data]]');
+	}
+	const isAdmin = await user.isAdministrator(socket.uid);
+	if (!isAdmin) {
+		throw new Error('[[error:no-privileges]]');
+	}
 	if (!data.remoteId) {
 		throw new Error('no-remote-id-supplied');
 	}
@@ -439,6 +447,7 @@ plugin.addMiddleware = async function ({ req, res }) {
 			const uid = await plugin.process(req.cookies[plugin.settings.cookieName]);
 			if (uid === req.uid) {
 				winston.verbose(`[session-sharing] Re-validated login for uid ${uid}, path ${req.originalUrl}`);
+				await nbbAuthController.onSuccessfulLogin(req, uid);
 				return;
 			}
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodebb-plugin-session-sharing",
-  "version": "8.0.0",
+  "version": "8.0.1",
   "description": "Allows login sessions from your app to persist in NodeBB",
   "main": "library.js",
   "repository": {