dandri/server
1
0
Fork 0
mirror of https://github.com/spacebarchat/server.git synced 2026-06-07 11:01:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use better permissions when handling webhook mentions

Browse Source
This commit is contained in:
Rory&
2026-06-05 22:59:33 +02:00
parent 79e5899dc1
commit 0573c394cf
3 changed files with 14 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
extra/admin-api/Tests/Spacebar.Tests/Tests/WebhookTests.cs
+1 -4
View File
@@ -1,7 +1,4 @@
using System.Net;
using System.Net.Http.Json;
using System.Text.Json.Nodes;
using Spacebar.Models.Generic;
using System.Text.Json.Nodes;
using Spacebar.Sdk.Core;
using Spacebar.Tests.Abstractions;
using Spacebar.Tests.Extensions;
src/api/util/handlers/Message.ts
+9 -2
View File
@@ -559,7 +559,8 @@ export async function postHandleMessage(message: Message) {
embed.type ||= EmbedType.rich;
});
if ((await getPermission(message.author_id, message.channel.guild_id, message.channel_id)).has(Permissions.FLAGS.EMBED_LINKS)) await fillMessageUrlEmbeds(message);
if (message.isWebhook || (await getPermission(message.author_id, message.channel.guild_id, message.channel_id)).has(Permissions.FLAGS.EMBED_LINKS))
await fillMessageUrlEmbeds(message);
}
export async function sendMessage(opts: MessageOptions) {
@@ -675,7 +676,13 @@ async function handleMessageMentionsAsync(message: Message) {
});
trace.calls.push(`getChannel(${channel.id})`, { micros: sw.getElapsedAndReset().totalMicroseconds });
const permission = await getPermission(message.author_id ?? message.author?.id, channel.guild_id, channel);
const permissionTargetId = message.isWebhook ? message.webhook?.application_id : (message.author_id ?? message.author?.id);
const permission =
permissionTargetId != null
? await getPermission(permissionTargetId, channel.guild_id, channel)
: message.guild_id != null
? new Permissions((await Role.findOneOrFail({ where: { id: message.guild_id ?? message.guild?.id } })).permissions)
: Permissions.DEFAULT_DM_PERMISSIONS;
trace.calls.push(`getPermissions`, { micros: sw.getElapsedAndReset().totalMicroseconds });
let content = message.content;
src/util/entities/Message.ts
+4
View File
@@ -242,6 +242,10 @@ export class Message extends BaseClass {
@Column({ default: "[]", type: "jsonb" })
message_snapshots: MessageSnapshot[];
get isWebhook() {
return this.webhook_id != null && this.webhook != null;
}
static async fillReplies(messages: Message[]) {
const ms = messages
.filter((msg) => msg.message_reference && !msg.referenced_message?.id && msg.message_reference.message_id)