Fix most glaring bugs and vulnerabilities

express/routes/api/v1/dictionaries.js

@@ -1,54 +1,91 @@
 const router = require('express-promise-router')()
 
 const dictionaries = require('../../../controllers/api/v1/dictionaries')
+const user = require('../../../middleware/user')
 
 // Update domain labels.
 router.post('/update-domain-labels', dictionaries.updateDomainLabels)
 
 // Update secondary domains
-router.post('/renovateSecondaryDomains', dictionaries.renovateSecondaryDomains)
+router.post(
+  '/renovateSecondaryDomains',
+  user.canAdministrateDictionaries,
+  dictionaries.renovateSecondaryDomains
+)
 
 // Delete specific dictionary.
-router.delete('/:dictionaryId', dictionaries.delete)
+router.delete(
+  '/:dictionaryId',
+  user.canAdministrateDictionary,
+  dictionaries.delete
+)
 
 // Change page in pagination
-router.get('/listAllDictionaries', dictionaries.listDictionaries)
+router.get(
+  '/listAllDictionaries',
+  user.canAdministrateDictionaries,
+  dictionaries.listDictionaries
+)
 
 // Change page in pagination
-router.get('/:dictionaryId/listDomainLabels', dictionaries.listDomainLabels)
-
-// Change page in pagination
-router.get('/listSecondaryDomains', dictionaries.listSecondaryDomains)
+router.get(
+  '/:dictionaryId/listDomainLabels',
+  user.canAdministrateDictionary,
+  dictionaries.listDomainLabels
+)
 
 // Change page in pagination
 router.get(
   '/:dictionaryId/showImportFromFileForm',
+  user.canContentEdit,
   dictionaries.showImportFromFileForm
 )
 
 // Change page in pagination
 router.get(
   '/:dictionaryId/showExportToFileForm',
+  user.canContentEdit,
   dictionaries.showExportToFileForm
 )
 
 // Delete all entries of specific dictionary.
-router.delete('/:dictionaryId/entries/all', dictionaries.deleteAllEntries)
+router.delete(
+  '/:dictionaryId/entries/all',
+  user.canAdministrateDictionary,
+  dictionaries.deleteAllEntries
+)
 
 // Publish all entries of specific dictionary.
-router.put('/:dictionaryId/entries/all/publish', dictionaries.publishAllEntries)
+router.put(
+  '/:dictionaryId/entries/all/publish',
+  user.canAdministrateDictionary,
+  dictionaries.publishAllEntries
+)
 
 // Import term candidates from extraction.
 router.post(
-  '/:id/import-extraction/:extractionId',
+  '/:dictionaryId/import-extraction/:extractionId',
+  user.canContentEdit,
   dictionaries.importFromExtraction
 )
 
 // Export dictionary into a file.
-router.post('/:id/export-begin', dictionaries.exportBegin)
+router.post(
+  '/:dictionaryId/export-begin',
+  user.canContentEdit,
+  dictionaries.exportBegin
+)
 
-router.get('/:dictionaryId/domainLabels', dictionaries.listFilteredDomainLabels)
+router.get(
+  '/:dictionaryId/domainLabels',
+  user.canContentEdit,
+  dictionaries.listFilteredDomainLabels
+)
 
-router.get('/secondaryDomains', dictionaries.listSecondaryDomainData)
+router.get(
+  '/secondaryDomains',
+  user.canAdministrateDictionaries,
+  dictionaries.listSecondaryDomainData
+)
 
 module.exports = router