From ed6fcefb67f5d28c779a7a6a9d63f4e5d650c2ab Mon Sep 17 00:00:00 2001 From: Richard Hansen Date: Thu, 1 Oct 2020 21:29:38 -0400 Subject: [PATCH] webaccess: Fix pad ID extraction for import and export paths --- src/node/hooks/express/webaccess.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/node/hooks/express/webaccess.js b/src/node/hooks/express/webaccess.js index 410fb4e5f..2ee28f55f 100644 --- a/src/node/hooks/express/webaccess.js +++ b/src/node/hooks/express/webaccess.js @@ -64,7 +64,7 @@ exports.checkAccess = (req, res, next) => { if (!level) return fail(); const user = req.session.user; if (user == null) return next(); // This will happen if authentication is not required. - const encodedPadId = (req.path.match(/^\/p\/(.*)$/) || [])[1]; + const encodedPadId = (req.path.match(/^\/p\/([^/]*)/) || [])[1]; if (encodedPadId == null) return next(); const padId = decodeURIComponent(encodedPadId); // The user was granted access to a pad. Remember the authorization level in the user's