This is an automated email from the ASF dual-hosted git repository.
humbedooh pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/incubator-ponymail-foal.git
The following commit(s) were added to refs/heads/master by this push:
new fe35f93 only return if email is accessible by session
fe35f93 is described below
commit fe35f9319e197659a45a264e05becacd26d1af56
Author: Daniel Gruno <[email protected]>
AuthorDate: Tue Jan 25 00:31:36 2022 +0100
only return if email is accessible by session
---
server/plugins/messages.py | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/server/plugins/messages.py b/server/plugins/messages.py
index cd1e49f..4f9be6a 100644
--- a/server/plugins/messages.py
+++ b/server/plugins/messages.py
@@ -261,6 +261,10 @@ async def get_email(
if doc and isinstance(doc, dict):
doc = doc["_source"]
doc["id"] = doc["mid"]
+ # If deleted by UI, only return if session is admin
+ is_admin = session.credentials and session.credentials.admin
+ if doc.get("deleted", False) and not is_admin:
+ return None
if doc and plugins.aaa.can_access_email(session, doc):
trim_email(doc)
if not session.credentials:
