Software: Apache/2.4.41 (Ubuntu). PHP/8.0.30 

uname -a: Linux apirnd 5.4.0-204-generic #224-Ubuntu SMP Thu Dec 5 13:38:28 UTC 2024 x86_64 

uid=33(www-data) gid=33(www-data) groups=33(www-data) 

Safe-mode: OFF (not secure)

/usr/local/lib/node_modules/homebridge-camera-ui/server/middlewares/   drwxr-xr-x
Free 13.34 GB of 57.97 GB (23.01%)
                            Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Self remove    Logout    

Viewing file:     auth.permission.middleware.js (2.03 KB)      -rw-r--r--

/* eslint-disable unicorn/prevent-abbreviations */
'use-strict';

exports.minimumPermissionLevelRequired = (required_permission_level) => {
  return (req, res, next) => {
    if (typeof required_permission_level === 'string') {
      required_permission_level = [required_permission_level];
    }

    const user_permission_level = req.jwt.permissionLevel || [];

    return user_permission_level.some((level) => required_permission_level.includes(level)) ||
      user_permission_level.includes('admin')
      ? next()
      : res.status(403).send({
          statusCode: 403,
          message: 'Forbidden',
        });
  };
};

exports.onlySameUserOrAdminCanDoThisAction = (req, res, next) => {
  let user_permission_level = req.jwt.permissionLevel || [];
  let userName = req.jwt.username;

  if (req.params && req.params.name && userName === req.params.name) {
    return next();
  } else {
    return user_permission_level.includes('users:edit') || user_permission_level.includes('admin')
      ? next()
      : res.status(403).send({
          statusCode: 403,
          message: 'Forbidden',
        });
  }
};

exports.onlySameUserOrMasterCanDoThisAction = (req, res, next) => {
  let user_permission_level = req.jwt.permissionLevel || [];
  let userName = req.jwt.name;

  if (req.params && req.params.name && userName === req.params.name) {
    return next();
  } else {
    return user_permission_level.includes('admin')
      ? next()
      : res.status(403).send({
          statusCode: 403,
          message: 'Forbidden',
        });
  }
};

exports.masterCantDoThisAction = (req, res, next) => {
  let user_permission_level = req.jwt.permissionLevel || [];

  return !user_permission_level.includes('admin')
    ? next()
    : res.status(403).send({
        statusCode: 403,
        message: 'Forbidden',
      });
};

exports.sameUserCantDoThisAction = (req, res, next) => {
  let userName = req.jwt.username;

  return req.params.name !== userName
    ? next()
    : res.status(403).send({
        statusCode: 403,
        message: 'Forbidden',
      });
};