From 4c778e9ccad6ae259db09f384a8e5917a0dbf8f5 Mon Sep 17 00:00:00 2001 From: Rory& Date: Wed, 6 May 2026 20:26:04 +0200 Subject: [PATCH] Security: fix TOTP verification logic for bot update/delete --- src/api/routes/applications/#application_id/index.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/api/routes/applications/#application_id/index.ts b/src/api/routes/applications/#application_id/index.ts index 64fac23c0..77874f3af 100644 --- a/src/api/routes/applications/#application_id/index.ts +++ b/src/api/routes/applications/#application_id/index.ts @@ -71,7 +71,7 @@ router.patch( if (app.owner.id != req.user_id) throw DiscordApiErrors.ACTION_NOT_AUTHORIZED_ON_APPLICATION; - if (app.owner.totp_secret && (!req.body.code || verifyToken(app.owner.totp_secret, req.body.code))) throw new HTTPError(req.t("auth:login.INVALID_TOTP_CODE"), 60008); + if (app.owner.totp_secret && (!req.body.code || !verifyToken(app.owner.totp_secret, req.body.code))) throw new HTTPError(req.t("auth:login.INVALID_TOTP_CODE"), 60008); if (body.name?.trim() == "") { throw FieldErrors({ @@ -127,7 +127,7 @@ router.post( }); if (app.owner.id != req.user_id) throw DiscordApiErrors.ACTION_NOT_AUTHORIZED_ON_APPLICATION; - if (app.owner.totp_secret && (!req.body.code || verifyToken(app.owner.totp_secret, req.body.code))) throw new HTTPError(req.t("auth:login.INVALID_TOTP_CODE"), 60008); + if (app.owner.totp_secret && (!req.body.code || !verifyToken(app.owner.totp_secret, req.body.code))) throw new HTTPError(req.t("auth:login.INVALID_TOTP_CODE"), 60008); if (app.bot) { await User.delete({ id: app.id }); }