From 5481b5a9170f864ebedeec080c2a8cf09fc2d159 Mon Sep 17 00:00:00 2001
From: Rory& <root@rory.gay>
Date: Sun, 25 Oct 2026 13:00:02 +0100
Subject: [PATCH] Automod: enforce guild id

---
 .../guilds/#guild_id/auto-moderation/rules.ts | 20 ++++++++++++-------
 src/util/util/Permissions.ts                  |  2 ++
 2 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/src/api/routes/guilds/#guild_id/auto-moderation/rules.ts b/src/api/routes/guilds/#guild_id/auto-moderation/rules.ts
index 0ece7adee..2e1d71d2e 100644
--- a/src/api/routes/guilds/#guild_id/auto-moderation/rules.ts
+++ b/src/api/routes/guilds/#guild_id/auto-moderation/rules.ts
@@ -27,7 +27,7 @@ const router: Router = Router({ mergeParams: true });
 router.get(
     "/",
     route({
-        permission: ["MANAGE_GUILD"],
+        permission: "MANAGE_GUILD",
         responses: {
             200: {
                 body: "AutomodRuleSchemaWithId[]",
@@ -48,7 +48,7 @@ router.post(
     "/",
     route({
         // requestBody: "AutomodRuleSchema",
-        permission: ["MANAGE_GUILD"],
+        permission: "MANAGE_GUILD",
         responses: {
             200: {
                 body: "AutomodRuleSchemaWithId",
@@ -74,10 +74,11 @@ router.post(
         const data = req.body as AutomodRuleSchema;
 
         const created = AutomodRule.create({
+            ...data,
             creator: await User.findOneOrFail({
                 where: { id: data.creator_id },
             }),
-            ...data,
+            guild_id: req.params.guild_id as string,
         });
 
         const savedRule = await AutomodRule.save(created);
@@ -89,7 +90,7 @@ router.patch(
     "/:rule_id",
     route({
         // requestBody: "AutomodRuleSchema
-        permission: ["MANAGE_GUILD"],
+        permission: "MANAGE_GUILD",
         responses: {
             200: {
                 body: "AutomodRuleSchemaWithId",
@@ -104,9 +105,10 @@ router.patch(
     }),
     async (req: Request, res: Response) => {
         const { rule_id } = req.params as { [key: string]: string };
-        const rule = await AutomodRule.findOneOrFail({
-            where: { id: rule_id },
+        const rule = await AutomodRule.findOne({
+            where: { id: rule_id, guild_id: req.params.guild_id as string },
         });
+        if (!rule) throw new HTTPError("Automod rule not found", 404);
 
         const data = req.body as AutomodRuleSchema;
 
@@ -119,7 +121,7 @@ router.patch(
 router.delete(
     "/:rule_id",
     route({
-        permission: ["MANAGE_GUILD"],
+        permission: "MANAGE_GUILD",
         responses: {
             204: {},
             403: {
@@ -132,6 +134,10 @@ router.delete(
     }),
     async (req: Request, res: Response) => {
         const { rule_id } = req.params as { [key: string]: string };
+        const rule = await AutomodRule.findOne({
+            where: { id: rule_id, guild_id: req.params.guild_id as string },
+        });
+        if (!rule) throw new HTTPError("Automod rule not found", 404);
         await AutomodRule.delete({ id: rule_id });
         return res.status(204).send();
     },
diff --git a/src/util/util/Permissions.ts b/src/util/util/Permissions.ts
index d7e4e1870..092706106 100644
--- a/src/util/util/Permissions.ts
+++ b/src/util/util/Permissions.ts
@@ -151,11 +151,13 @@ export class Permissions extends BitField {
         user: { id: string; roles: string[]; communication_disabled_until: Date | null; flags: number };
         guild: { id: string; owner_id: string; roles: Role[] };
         channel?: {
+            guild_id?: string;
             overwrites?: ChannelPermissionOverwrite[];
             recipient_ids?: string[] | null;
             owner_id?: string;
         };
     }) {
+        if (channel?.guild_id && channel?.guild_id != guild.id) throw new HTTPError("Target channel does not belong to guild");
         if (user.id === "0") return new Permissions("ADMINISTRATOR"); // system user id
         if (guild?.owner_id === user.id) return new Permissions(Permissions.ALL);