How to check user access in custom view?

simov / express-admin

MySQL, MariaDB, PostgreSQL, SQLite admin for Node.js

MIT License

1.17k stars 223 forks source link

How to check user access in custom view? #83

Closed ghost closed 1 year ago

ghost commented 9 years ago

I have a get request like "site.com/admin/fs/download?filename=blahblah.pdf", where fs is my custom view. How can I check in my custom view if user have access to express admin? Because now everyone can execute this query without login.

ghost commented 9 years ago

Ok, i checked out the auth.js and

if (!req.session.user) next();

works for me

simov commented 9 years ago

Yes, and you can have multiple users registered to use the admin - check out this comment

Also if you are POSTing data to the server don't forget to add a CSRF token in your web forms, just check out how this is done in the editview template.