dandri/server
1
0
Fork 0
mirror of https://github.com/spacebarchat/server.git synced 2026-09-02 06:54:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

Security: check bot ownership when resetting token

Browse Source
This commit is contained in:
Rory&
2026-05-06 20:21:03 +02:00
parent 1e99ed9e57
commit bd5f0a2afe
2 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/api/routes/applications/#application_id/bot/index.ts
+8 -8
View File
@@ -66,18 +66,18 @@ router.post(
},
}),
async (req: Request, res: Response) => {
const bot = await User.findOneOrFail({ where: { id: req.params.application_id as string, bot: true } });
const owner = req.user;
const botApplication = await Application.findOneOrFail({ where: { id: req.params.application_id as string }, relations: { bot: true } });
if (owner.id != req.user_id) throw DiscordApiErrors.ACTION_NOT_AUTHORIZED_ON_APPLICATION;
// TODO: handle teams
if (botApplication.owner_id != req.user_id) throw DiscordApiErrors.ACTION_NOT_AUTHORIZED_ON_APPLICATION;
if (owner.totp_secret && (!req.body.code || verifyToken(owner.totp_secret, req.body.code))) throw new HTTPError(req.t("auth:login.INVALID_TOTP_CODE"), 60008);
const botOwner = await User.findOneOrFail({ where: { id: botApplication.owner_id } });
if (botOwner.totp_secret && (!req.body.code || verifyToken(botOwner.totp_secret, req.body.code))) throw new HTTPError(req.t("auth:login.INVALID_TOTP_CODE"), 60008);
bot.data = { hash: undefined, valid_tokens_since: new Date() };
botApplication.bot!.data = { hash: undefined, valid_tokens_since: new Date() };
await botApplication.bot!.save();
await bot.save();
const token = await generateToken(bot.id);
const token = await generateToken(botApplication.id);
res.json({ token }).status(200);
},
src/util/entities/Application.ts
+4
View File
@@ -57,6 +57,10 @@ export class Application extends BaseClass {
@ManyToOne(() => User, { onDelete: "CASCADE" })
owner: User;
@Column()
@RelationId((application: Application) => application.owner)
owner_id: string;
// TODO: enum this? https://discord.com/developers/docs/resources/application#application-object-application-flags
@Column()
flags: number = 0;