Fix authorisation bypass vulnerability

controllers/albumsController.js

@@ -8,7 +8,8 @@ const Zip = require('jszip');
 const albumsController = {};
 
 albumsController.list = async (req, res, next) => {
-	const user = await utils.authorize(req, res);
+	const {user, response} = await utils.authorize(req, res);
+	if(!user) return response;
 
 	const fields = ['id', 'name'];
 	if (req.params.sidebar === undefined) {
@@ -41,7 +42,8 @@ albumsController.list = async (req, res, next) => {
 };
 
 albumsController.create = async (req, res, next) => {
-	const user = await utils.authorize(req, res);
+	const {user, response} = await utils.authorize(req, res);
+	if(!user) return response;
 
 	const name = req.body.name;
 	if (name === undefined || name === '') {
@@ -70,7 +72,8 @@ albumsController.create = async (req, res, next) => {
 };
 
 albumsController.delete = async (req, res, next) => {
-	const user = await utils.authorize(req, res);
+	const {user, response} = await utils.authorize(req, res);
+	if(!user) return response;
 
 	const id = req.body.id;
 	if (id === undefined || id === '') {
@@ -82,7 +85,8 @@ albumsController.delete = async (req, res, next) => {
 };
 
 albumsController.rename = async (req, res, next) => {
-	const user = await utils.authorize(req, res);
+	const {user, response} = await utils.authorize(req, res);
+	if(!user) return response;
 
 	const id = req.body.id;
 	if (id === undefined || id === '') {

controllers/tokenController.js

@@ -15,12 +15,14 @@ tokenController.verify = async (req, res, next) => {
 };
 
 tokenController.list = async (req, res, next) => {
-	const user = await utils.authorize(req, res);
+	const {user, response} = await utils.authorize(req, res);
+	if(!user) return response;
 	return res.json({ success: true, token: user.token });
 };
 
 tokenController.change = async (req, res, next) => {
-	const user = await utils.authorize(req, res);
+	const {user, response} = await utils.authorize(req, res);
+	if(!user) return response;
 	const newtoken = randomstring.generate(64);
 
 	await db.table('users').where('token', user.token).update({

controllers/uploadController.js

@@ -47,7 +47,8 @@ const upload = multer({
 
 uploadsController.upload = async (req, res, next) => {
 	if (config.private === true) {
-		await utils.authorize(req, res);
+		const {user, response} = await utils.authorize(req, res);
+		if(!user) return response;
 	}
 
 	const token = req.headers.token || '';
@@ -185,7 +186,8 @@ uploadsController.processFilesForDisplay = async (req, res, files, existingFiles
 };
 
 uploadsController.delete = async (req, res) => {
-	const user = await utils.authorize(req, res);
+	const {user, response} = await utils.authorize(req, res);
+	if(!user) return response;
 	const id = req.body.id;
 	if (id === undefined || id === '') {
 		return res.json({ success: false, description: 'No file specified' });
@@ -240,7 +242,8 @@ uploadsController.deleteFile = function(file) {
 };
 
 uploadsController.list = async (req, res) => {
-	const user = await utils.authorize(req, res);
+	const {user, response} = await utils.authorize(req, res);
+	if(!user) return response;
 
 	let offset = req.params.page;
 	if (offset === undefined) offset = 0;

controllers/utilsController.js

@@ -21,13 +21,19 @@ utilsController.getPrettyDate = function(date) {
 		+ date.getSeconds();
 };
 
+utilsController.getUser = async (req) => {
+	const token = req.headers.token;
+	if(token === undefined) return null;
+	return await db.table('users').where('token', token).first();
+};
+
 utilsController.authorize = async (req, res) => {
 	const token = req.headers.token;
-	if (token === undefined) return res.status(401).json({ success: false, description: 'No token provided' });
+	if (token === undefined) return {user: null, response: res.status(401).json({ success: false, description: 'No token provided' })};
 
 	const user = await db.table('users').where('token', token).first();
-	if (!user) return res.status(401).json({ success: false, description: 'Invalid token' });
-	return user;
+	if (!user) return {user: null, response: res.status(401).json({ success: false, description: 'Invalid token' })};
+	return {user: user, response: null};
 };
 
 utilsController.generateThumbs = function(file, basedomain) {