-
Notifications
You must be signed in to change notification settings - Fork 2
Open
Labels
Description
In router.js at delete post, You already checking if a user is authorized and have a valid token then it will next you to handleDeletePost,
Blog-Post/server/router/index.js
Line 31 in ce45315
| router.delete('/post/:id', checkAuth, handleDeletePost); |
So any user who has an account can delete any post even it's not his own post.
So we need a query to check if the user who sends the request is the same person who has the post before deleting it.
Reactions are currently unavailable