From d85eeee5f4ba7f54267817b1c28828573723f700 Mon Sep 17 00:00:00 2001
From: Peter 'Pita' Martischka <petermartischka@googlemail.com>
Date: Sun, 21 Aug 2011 19:43:42 +0100
Subject: [PATCH] check pad access on read only

---
 node/server.js | 105 ++++++++++++++++++++++++++-----------------------
 1 file changed, 56 insertions(+), 49 deletions(-)

diff --git a/node/server.js b/node/server.js
index 6238ae0a..cfc9535b 100644
--- a/node/server.js
+++ b/node/server.js
@@ -118,55 +118,6 @@ async.waterfall([
       }
     });
     
-    //serve read only pad
-    app.get('/ro/:id', function(req, res)
-    { 
-      res.header("Server", serverName);
-      
-      var html;
-      var padId;
-      var pad;
-      
-      async.series([
-        //translate the read only pad to a padId
-        function(callback)
-        {
-          readOnlyManager.getPadId(req.params.id, function(err, _padId)
-          {
-            padId = _padId;
-            callback(err);
-          });
-        },
-        //render the html document
-        function(callback)
-        {
-          //return if the there is no padId
-          if(padId == null)
-          {
-            callback("notfound");
-            return;
-          }
-          
-          //render the html document
-          exporthtml.getPadHTMLDocument(padId, null, false, function(err, _html)
-          {
-            html = _html;
-            callback(err);
-          });
-        }
-      ], function(err)
-      {
-        //throw any unexpected error
-        if(err && err != "notfound")
-          throw err;
-          
-        if(err == "notfound")
-          res.send('404 - Not Found', 404);
-        else
-          res.send(html);
-      });
-    });
-    
     //checks for padAccess
     function hasPadAccess(req, res, callback)
     {
@@ -187,6 +138,62 @@ async.waterfall([
       });
     }
     
+    //serve read only pad
+    app.get('/ro/:id', function(req, res)
+    { 
+      res.header("Server", serverName);
+      
+      var html;
+      var padId;
+      var pad;
+      
+      async.series([
+        //translate the read only pad to a padId
+        function(callback)
+        {
+          readOnlyManager.getPadId(req.params.id, function(err, _padId)
+          {
+            padId = _padId;
+            
+            //we need that to tell hasPadAcess about the pad  
+            req.params.pad = padId; 
+            
+            callback(err);
+          });
+        },
+        //render the html document
+        function(callback)
+        {
+          //return if the there is no padId
+          if(padId == null)
+          {
+            callback("notfound");
+            return;
+          }
+          
+          hasPadAccess(req, res, function()
+          {
+            //render the html document
+            exporthtml.getPadHTMLDocument(padId, null, false, function(err, _html)
+            {
+              html = _html;
+              callback(err);
+            });
+          });
+        }
+      ], function(err)
+      {
+        //throw any unexpected error
+        if(err && err != "notfound")
+          throw err;
+          
+        if(err == "notfound")
+          res.send('404 - Not Found', 404);
+        else
+          res.send(html);
+      });
+    });
+        
     //serve pad.html under /p
     app.get('/p/:pad', function(req, res, next)
     {