search

JoelNiemela / archivium

2 stars 1 forks source link

Fix access rules for discussion threads #75

Open kjniemela opened 1 day ago

kjniemela commented 1 day ago

For a thread with ID x that belongs to universe a, the correct URL is /universes/a/discuss/x. It is, however, possible to access this thread via any universe you have access to, for example: /universes/b/discuss/x. This can lead to a lot of weird behavior, especially if universe b does not have discussions enabled.

kjniemela commented 1 day ago

Another issue that is very related to this, trying to access a thread that doesn't exist results in a 200 response, not a 404.