BigBlueButton/bigbluebutton-Github
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #13866 from ramonlsouza/presenter-polls

Browse Source 
fix: increase current-poll security
This commit is contained in:
Anton Georgiev 2021-12-15 13:40:19 -05:00 committed by GitHub
commit c7206bb59e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
bigbluebutton-html5/imports/api/polls/server/publishers.js
View File

@ -32,11 +32,12 @@ function currentPoll(secretPoll) {
const User = Users.findOne({ userId, meetingId }, { fields: { role: 1, presenter: 1 } });
if (!!User && (User.role === ROLE_MODERATOR || User.presenter)) {
if (!!User && User.presenter) {
Logger.debug('Publishing Polls', { meetingId, userId });
const selector = {
meetingId,
requester: userId,
};
const options = { fields: {} };
@ -45,13 +46,16 @@ function currentPoll(secretPoll) {
if ((hasPoll && hasPoll.secretPoll) || secretPoll) {
options.fields.responses = 0;
selector.secretPoll = true;
} else {
selector.secretPoll = false;
}
return Polls.find(selector, options);
}
Logger.warn(
'Publishing current-poll was requested by non-moderator connection',
'Publishing current-poll was requested by non-presenter connection',
{ meetingId, userId, connectionId: this.connection.id },
);
return Polls.find({ meetingId: '' });