fix security check

BaptisteBuvron · Jun 22, 2023 · 1723569 · 1723569
1 parent b36919b
commit 1723569
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 5 deletions.
diff --git a/app/passport/passportFunctions.ts b/app/passport/passportFunctions.ts
@@ -97,7 +97,7 @@ function loggedIn() {
             next();
         } else {
             let message = "Vous n'êtes pas connecté";
-            res.redirect(`/login?message=${message}`, {title: "Connexion"});
+            res.redirect(`/login?message=${message}`);
         }
     };
 }

diff --git a/app/routes/MainRouter.ts b/app/routes/MainRouter.ts
@@ -7,7 +7,7 @@ import {createCSRFToken} from "../middlewares/CSRFMiddlewares";
 const {v4: uuidv4} = require("uuid");
 const session = require("express-session");
 const FileStore = require("session-file-store")(session);
-const {passport, checkRole} = require("../passport/passportFunctions");
+const {passport, checkRole, checkRoleTwoProfile} = require("../passport/passportFunctions");
 
 export const defaultRouter = Router();
 
@@ -60,8 +60,8 @@ defaultRouter.post("/canditature/:numero", checkRole("Candidat"), upload.fields(
     {name: 'cv', maxCount: 1},
     {name: 'lettre', maxCount: 1}
 ]), CandidatureController.candidater);
-defaultRouter.get("/candidature/:email/:numero", CandidatureController.candidature);
-defaultRouter.get("/download/:id", CandidatureController.getFile);
+defaultRouter.get("/candidature/:email/:numero", checkRoleTwoProfile("Candidat", "Recruteur"), CandidatureController.candidature);
+defaultRouter.get("/download/:id", checkRoleTwoProfile("Candidat", "Recruteur"), CandidatureController.getFile);
 
 
 defaultRouter.post(

diff --git a/app/routes/OfferRouter.ts b/app/routes/OfferRouter.ts
@@ -8,4 +8,4 @@ offerRouter.use(passport.initialize());
 offerRouter.use(passport.session());
 offerRouter.get("/creation", checkRole("Recruteur"), OfferController.creation);
 offerRouter.post("/creation", checkRole("Recruteur"), OfferController.creation);
-offerRouter.get("/:numero", OfferController.offre);
+offerRouter.get("/:numero", loggedIn(), OfferController.offre);