add missing valid pve token check to checkAuth

src/routes/access.js

@@ -115,6 +115,12 @@ router.post("/password", async (req, res) => {
 		password: req.body.password
 	};
 
+	// check auth
+	const auth = await checkAuth(req.cookies, res);
+	if (!auth) {
+		return;
+	}
+
 	const userObj = global.utils.getUserObjFromUsername(params.username);
 	const newAttributes = {
 		userpassword: params.password

src/routes/access/groups.js

@@ -1,6 +1,8 @@
 import { Router } from "express";
 export const router = Router({ mergeParams: true });
 
+const checkAuth = global.utils.checkAuth;
+
 /**
  * GET - get all groups
  * responses:
@@ -8,9 +10,10 @@ export const router = Router({ mergeParams: true });
  * - 201: {auth: false}
  */
 router.get("/", async (req, res) => {
-    const auth = await checkAuth(req.cookies, res);
+	// check auth
+	const auth = await checkAuth(req.cookies, res);
 	if (!auth) {
 		return;
 	}
-    res.status(200).send(global.userManager.getAllGroups())
-});
+	res.status(200).send(global.userManager.getAllGroups());
+});

src/routes/access/users.js

@@ -1,6 +1,8 @@
 import { Router } from "express";
 export const router = Router({ mergeParams: true });
 
+const checkAuth = global.utils.checkAuth;
+
 /**
  * GET - get all users
  * responses:
@@ -8,9 +10,10 @@ export const router = Router({ mergeParams: true });
  * - 201: {auth: false}
  */
 router.get("/", async (req, res) => {
-    const auth = await checkAuth(req.cookies, res);
+	// check auth
+	const auth = await checkAuth(req.cookies, res);
 	if (!auth) {
 		return;
 	}
-    res.status(200).send(global.userManager.getAllUsers())
-});
+	res.status(200).send(global.userManager.getAllUsers());
+});

src/routes/user.js

@@ -12,13 +12,17 @@ const getUserResources = global.utils.getUserResources;
  * - 401: {auth: false}
  */
 router.get("/dynamic/resources", async (req, res) => {
+	const params = {
+		username: req.cookies.username
+	};
+
 	// check auth
 	const auth = await checkAuth(req.cookies, res);
 	if (!auth) {
 		return;
 	}
 
-	const userObj = global.utils.getUserObjFromUsername(req.cookies.username);
+	const userObj = global.utils.getUserObjFromUsername(params.username);
 
 	const resources = await getUserResources(req, userObj);
 	res.status(200).send(resources);