dandri/server
1
0
Fork 0
mirror of https://github.com/spacebarchat/server.git synced 2026-09-04 12:53:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

Security: fix TOTP verification logic for bot update/delete

Browse Source
This commit is contained in:
Rory&
2026-05-06 20:26:04 +02:00
parent bd5f0a2afe
commit 4c778e9cca
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/api/routes/applications/#application_id/index.ts
+2 -2
View File
@@ -71,7 +71,7 @@ router.patch(
if (app.owner.id != req.user_id) throw DiscordApiErrors.ACTION_NOT_AUTHORIZED_ON_APPLICATION;
if (app.owner.totp_secret && (!req.body.code || verifyToken(app.owner.totp_secret, req.body.code))) throw new HTTPError(req.t("auth:login.INVALID_TOTP_CODE"), 60008);
if (app.owner.totp_secret && (!req.body.code || !verifyToken(app.owner.totp_secret, req.body.code))) throw new HTTPError(req.t("auth:login.INVALID_TOTP_CODE"), 60008);
if (body.name?.trim() == "") {
throw FieldErrors({
@@ -127,7 +127,7 @@ router.post(
});
if (app.owner.id != req.user_id) throw DiscordApiErrors.ACTION_NOT_AUTHORIZED_ON_APPLICATION;
if (app.owner.totp_secret && (!req.body.code || verifyToken(app.owner.totp_secret, req.body.code))) throw new HTTPError(req.t("auth:login.INVALID_TOTP_CODE"), 60008);
if (app.owner.totp_secret && (!req.body.code || !verifyToken(app.owner.totp_secret, req.body.code))) throw new HTTPError(req.t("auth:login.INVALID_TOTP_CODE"), 60008);
if (app.bot) {
await User.delete({ id: app.id });
}