public/photoview
1
0
Fork 0
mirror of https://git.vectorsigma.ru/public/photoview.git synced 2026-08-03 18:19:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix bug where one user would load another users image faces

Browse Source
This commit is contained in:
viktorstrate
2021-02-26 21:49:01 +01:00
parent 91d94ecc82
commit 7bdf02b726
1 changed files with 40 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
api/graphql/resolvers/faces.go
View File

@@ -43,7 +43,25 @@ func (r imageFaceResolver) FaceGroup(ctx context.Context, obj *models.ImageFace)
}
func (r faceGroupResolver) ImageFaces(ctx context.Context, obj *models.FaceGroup, paginate *models.Pagination) ([]*models.ImageFace, error) {
query := r.Database.Joins("Media").Where("face_group_id = ?", obj.ID)
user := auth.UserFromContext(ctx)
if user == nil {
return nil, errors.New("unauthorized")
}
if err := user.FillAlbums(r.Database); err != nil {
return nil, err
}
userAlbumIDs := make([]int, len(user.Albums))
for i, album := range user.Albums {
userAlbumIDs[i] = album.ID
}
query := r.Database.
Joins("Media").
Where("face_group_id = ?", obj.ID).
Where("media.album_id IN (?)", userAlbumIDs)
query = models.FormatSQL(query, nil, paginate)
var imageFaces []*models.ImageFace
@@ -55,8 +73,28 @@ func (r faceGroupResolver) ImageFaces(ctx context.Context, obj *models.FaceGroup
}
func (r faceGroupResolver) ImageFaceCount(ctx context.Context, obj *models.FaceGroup) (int, error) {
user := auth.UserFromContext(ctx)
if user == nil {
return -1, errors.New("unauthorized")
}
if err := user.FillAlbums(r.Database); err != nil {
return -1, err
}
userAlbumIDs := make([]int, len(user.Albums))
for i, album := range user.Albums {
userAlbumIDs[i] = album.ID
}
query := r.Database.
Model(&models.ImageFace{}).
Joins("Media").
Where("face_group_id = ?", obj.ID).
Where("media.album_id IN (?)", userAlbumIDs)
var count int64
if err := r.Database.Model(&models.ImageFace{}).Where("face_group_id = ?", obj.ID).Count(&count).Error; err != nil {
if err := query.Count(&count).Error; err != nil {
return -1, err
}