From d8d0d42374fff2c5cbe03182967a60f8a1841a9b Mon Sep 17 00:00:00 2001 From: Agusti Fernandez Pardo Date: Sat, 4 Jun 2022 02:26:16 +0200 Subject: [PATCH] fix: only check event type ownership if not admin --- pages/api/event-types/[id].ts | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/pages/api/event-types/[id].ts b/pages/api/event-types/[id].ts index 81cefb3ab7..19435a0bc6 100644 --- a/pages/api/event-types/[id].ts +++ b/pages/api/event-types/[id].ts @@ -27,10 +27,9 @@ export async function eventTypeById( select: { eventTypes: true }, }); const userEventTypes = data.eventTypes.map((eventType) => eventType.id); - - if (!isAdmin || !userEventTypes.includes(safeQuery.data.id)) - res.status(401).json({ message: "Unauthorized" }); - else { + if (!isAdmin) { + if (!userEventTypes.includes(safeQuery.data.id)) res.status(401).json({ message: "Unauthorized" }); + } else { switch (method) { /** * @swagger