message: Added more security
diff: @@ -8,7 +8,7 @@ const appRoot = require('app-root-path');
  import {Response} from 'express';
  import {
  Body, Post, Get, Header, NotFoundError, ContentType, UseInterceptor, OnUndefined, UseBefore, Param, Res, Controller,
  - Action
  + Action, CurrentUser
  } from 'routing-controllers';
  import passportJwtMiddleware from '../security/passportJwtMiddleware';
  @@ -25,7 +25,9 @@ import {FileUnit} from '../models/units/FileUnit';
  import {VideoUnit} from '../models/units/VideoUnit';
  import {IVideoUnit} from '../../../shared/models/units/IVideoUnit';
  import {Task} from '../models/Task';
  -import {Lecture} from "../models/Lecture";
  +import {Lecture} from '../models/Lecture';
  +import {IUser} from '../../../shared/models/IUser';
  +import {Course} from '../models/Course';
  // Set all routes to json, because the download is streaming data and do not use json headers
  @@ -96,7 +98,11 @@ export class DownloadController {
  @Post('/')
  @ContentType('application/json')
  - async postDownloadRequest(@Body() data: IDownload) {
  + async postDownloadRequest(@Body() data: IDownload, @CurrentUser() user: IUser) {
  +
  + const course = await Course.findOne({_id: data.courseName});
  +
  + if (course.students.indexOf(user._id) !== -1 || course.courseAdmin === user._id || course.teachers.indexOf(user._id) !== -1) {
  if (data.lectures.length === 0) {
  throw new NotFoundError();
  @@ -115,10 +121,6 @@ export class DownloadController {
  zlib: {level: 9} // Sets the compression level.
  });
  - archive.on('error', function (err: Error) {
  - throw err;
  - });
  -
  archive.pipe(output);
  let lecCounter = 1;
  @@ -133,8 +135,10 @@ export class DownloadController {
  const localUnit = await Unit.findOne({_id: unit.unitId});
  if (localUnit instanceof FreeTextUnit) {
  const freeTextUnit = <IFreeTextUnit><any>localUnit;
  - archive.append(freeTextUnit.name + '\n' + freeTextUnit.description + '\n' + freeTextUnit.markdown, {name: lecCounter + '_' +
  - localLecture.name + '/' + unitCounter + '_' + freeTextUnit.name + '.md'});
  + archive.append(freeTextUnit.name + '\n' + freeTextUnit.description + '\n' + freeTextUnit.markdown, {
  + name: lecCounter + '_' +
  + localLecture.name + '/' + unitCounter + '_' + freeTextUnit.name + '.md'
  + });
  } else if (localUnit instanceof CodeKataUnit) {
  const codeKataUnit = <ICodeKataUnit><any>localUnit;
  archive.append(codeKataUnit.description + '\n' + codeKataUnit.definition + '\n' +
  @@ -174,11 +178,15 @@ export class DownloadController {
  }
  lecCounter++;
  }
  -
  - return new Promise(resolve => {
  + return new Promise((resolve, reject) => {
  + archive.on('error', () => reject(fileName));
  archive.finalize();
  archive.on('end', () => resolve(fileName));
  });
  + } else {
  + throw new NotFoundError();
  }
  + }
  +
  }
  