dandri/server
1
0
Fork 0
mirror of https://github.com/spacebarchat/server.git synced 2026-07-21 15:30:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

Restrict reading of application emojis

Browse Source
This commit is contained in:
Rory&
2026-07-01 19:46:31 +02:00
parent 0e4ac09490
commit 15dae644a9
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/api/routes/applications/#application_id/emojis.ts
+7 -1
View File
@@ -39,7 +39,9 @@ router.get(
async (req: Request, res: Response) => {
const { application_id } = req.params as { [key: string]: string };
// TODO: is there *any* gating on this endpoint?
const app = await Application.findOne({ where: { id: application_id } });
if (!app) throw DiscordApiErrors.UNKNOWN_APPLICATION;
if (req.user_id != app?.id && req.user_id != app?.owner_id) throw DiscordApiErrors.ACTION_NOT_AUTHORIZED_ON_APPLICATION;
const emojis = await Emoji.find({
where: { application_id: application_id },
@@ -68,6 +70,10 @@ router.get(
async (req: Request, res: Response) => {
const { application_id, emoji_id } = req.params as { [key: string]: string };
const app = await Application.findOne({ where: { id: application_id } });
if (!app) throw DiscordApiErrors.UNKNOWN_APPLICATION;
if (req.user_id != app?.id && req.user_id != app?.owner_id) throw DiscordApiErrors.ACTION_NOT_AUTHORIZED_ON_APPLICATION;
const emoji = await Emoji.findOneOrFail({
where: { application_id: application_id, id: emoji_id },
relations: { user: true },