Modified access to GET /api/boards/:boardId/lists

8 years ago · 066593f9c3
parent 1e8d9f02f3
commit 066593f9c3
1 changed files with 2 additions and 1 deletions
--- a/models/lists.js
+++ b/models/lists.js
@ -132,8 +132,9 @@ if (Meteor.isServer) {
 //LISTS REST API
 if (Meteor.isServer) {
  JsonRoutes.add('GET', '/api/boards/:boardId/lists', function (req, res, next) {
-    Authentication.checkUserId( req.userId);
    const paramBoardId = req.params.boardId;
+    Authentication.checkBoardAccess( req.userId, paramBoardId);
+
    JsonRoutes.sendResult(res, {
      code: 200,
      data: Lists.find({ boardId: paramBoardId, archived: false }).map(function (doc) {