Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
offset: req.query.offset || undefined,
limit: req.query.limit || 100,
sort: {
updatedAt: -1
}
};
if (!checkUserAccessLevel(req.user.role, accessLevels.root)) {
//non root user limitations
select.deleted = -1;
select.loginCounter = -1;
select.settings = -1;
select.beerCounter = -1;
select.lastLogin = -1;
select.lastIp = -1;
select["telegram.id"] = -1;
select["telegram.enabled"] = 1;
select["telegram.username"] = -1;
select["telegram.first_name"] = -1;
select["telegram.last_name"] = -1;
select["telegram.language_code"] = -1;
query.deleted = false;
}
if (!id) {
DB.User.find(query, select, options, (err, users) => {
if (err) {
console.error(err);
return res.sendStatus(500);
}
res.send(users);
});
} else {
query._id = id;
DB.User.findOneAndUpdate(query, data, options, (err, user) => {
if (err) {
console.error(err);
return res.sendStatus(500);
} else if (!user) {
return res.sendStatus(404);
}
if (!user.telegram.enabled && data.$set && data.$set["telegram.enabled"] == true && data.sendNotification) {
botNotifications.accountEnabledDisabled(user, true);
bot.broadcastMessage("User *" + user.email + "* enabled by *" + req.user.email + "*", accessLevels.admin, null, true);
} else if (user.telegram.enabled && data.$set && data.$set["telegram.enabled"] == false && data.sendNotification) {
botNotifications.accountEnabledDisabled(user, false);
bot.broadcastMessage("User *" + user.email + "* disabled by *" + req.user.email + "*", accessLevels.admin, null, true);
}
res.sendStatus(200);
});