From 36940dc979c2ee0f55ee98720d83c45389f9a7b6 Mon Sep 17 00:00:00 2001 From: Rory& Date: Wed, 6 May 2026 20:39:13 +0200 Subject: [PATCH] Security: validate token for webhook update --- src/api/routes/webhooks/#webhook_id/#token/index.ts | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/api/routes/webhooks/#webhook_id/#token/index.ts b/src/api/routes/webhooks/#webhook_id/#token/index.ts index 4d219cc14..7167b5847 100644 --- a/src/api/routes/webhooks/#webhook_id/#token/index.ts +++ b/src/api/routes/webhooks/#webhook_id/#token/index.ts @@ -150,7 +150,6 @@ router.patch( }, }), async (req: Request, res: Response) => { - // noinspection JSUnusedLocalSymbols - TODO: shouldnt token be checked? const { webhook_id, token } = req.params as { [key: string]: string }; const body = req.body as WebhookUpdateSchema; @@ -158,6 +157,11 @@ router.patch( where: { id: webhook_id }, relations: { user: true, channel: true, source_channel: true, guild: true, source_guild: true, application: true }, }); + + if (webhook.token !== token) { + throw DiscordApiErrors.INVALID_WEBHOOK_TOKEN_PROVIDED; + } + const channel_id = webhook.channel_id; if (!body.name && !body.avatar) { throw new HTTPError("Empty webhook updates are not allowed", 50006);