Merge pull request #114 from yujular/main

feat: add admin check for @ and # tag in CreateTag
OpenTreeHole · Sep 17, 2023 · 68997d7 · 68997d7
2 parents 057cfdd + 1c2a95f
commit 68997d7
Showing 1 changed file with 16 additions and 0 deletions.
diff --git a/apis/tag/apis.go b/apis/tag/apis.go
@@ -1,6 +1,8 @@
 package tag
 
 import (
+	"strings"
+
 	"github.com/opentreehole/go-common"
 	"gorm.io/plugin/dbresolver"
 
@@ -85,6 +87,20 @@ func CreateTag(c *fiber.Ctx) error {
 		return err
 	}
 
+	// check tag prefix
+	user, err := GetUser(c)
+	if err != nil {
+		return err
+	}
+	if !user.IsAdmin {
+		if strings.HasPrefix(body.Name, "#") {
+			return common.BadRequest("只有管理员才能创建 # 开头的 tag")
+		}
+		if strings.HasPrefix(body.Name, "@") {
+			return common.BadRequest("只有管理员才能创建 @ 开头的 tag")
+		}
+	}
+
 	// bind and create tag
 	tag.Name = body.Name
 	result := DB.Where("name = ?", body.Name).FirstOrCreate(&tag)