eightball/PluralKit
1
0
Fork 0
mirror of https://github.com/PluralKit/PluralKit.git synced 2026-02-04 04:56:49 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix(api): limit autoproxy member patch to own system

Browse source
This commit is contained in:
spiral 2022-12-31 02:17:26 +00:00
parent f0aa48f00a
commit 5c0472eb95
No known key found for this signature in database
GPG key ID: 244A11E4B0BCF40E
1 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
PluralKit.API/Controllers/v2/AutoproxyControllerV2.cs
View file

@ -57,7 +57,11 @@ public class AutoproxyControllerV2: PKControllerBase
PKMember? member = null; PKMember? member = null;
if (updateMember) if (updateMember)
{
member = await ResolveMember(data.Value<string>("autoproxy_member")); member = await ResolveMember(data.Value<string>("autoproxy_member"));
if (member != null && ContextFor(member) != LookupContext.ByOwner)
throw Errors.GenericMissingPermissions;
}
var patch = AutoproxyPatch.FromJson(data, member?.Id); var patch = AutoproxyPatch.FromJson(data, member?.Id);