From 7e597226ecb562ae7ca70a5aec9d37c42405aa54 Mon Sep 17 00:00:00 2001
From: Erik Michelson
Date: Wed, 17 Feb 2021 22:02:47 +0100
Subject: Add HTTP 404 error on non-existent note downloads

When FreeURL mode is enabled and you called the /download route, the note was created and the user redirected to the blank note.
This is caused because the findNote method automatically creates a note when no existing one is found.
This commit adds a new parameter to the findNote method which allows to disable this behaviour. In that case a HTTP 404 error will be returned.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
---
 lib/web/note/controller.js | 2 +-
 lib/web/note/util.js       | 7 +++++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/lib/web/note/controller.js b/lib/web/note/controller.js
index 45aea9e2..94bfa0e2 100644
--- a/lib/web/note/controller.js
+++ b/lib/web/note/controller.js
@@ -119,7 +119,7 @@ exports.doAction = function (req, res, next) {
       default:
         return res.redirect(config.serverURL + '/' + noteId)
     }
-  })
+  }, null, false)
 }
 
 exports.downloadMarkdown = function (req, res, note) {
diff --git a/lib/web/note/util.js b/lib/web/note/util.js
index 57438515..effeb41c 100644
--- a/lib/web/note/util.js
+++ b/lib/web/note/util.js
@@ -5,7 +5,7 @@ const errors = require('../../errors')
 const fs = require('fs')
 const path = require('path')
 
-exports.findNote = function (req, res, callback, include) {
+exports.findNote = function (req, res, callback, include, createIfNotFound = true) {
   const id = req.params.noteId || req.params.shortid
   models.Note.parseNoteId(id, function (err, _id) {
     if (err) {
@@ -18,9 +18,12 @@ exports.findNote = function (req, res, callback, include) {
       },
       include: include || null
     }).then(function (note) {
-      if (!note) {
+      if (!note && createIfNotFound) {
         return exports.newNote(req, res, '')
       }
+      if (!note && !createIfNotFound) {
+        return errors.errorNotFound(res)
+      }
       if (!exports.checkViewPermission(req, note)) {
         return errors.errorForbidden(res)
       } else {
-- 
cgit v1.2.3