From bd5f0a2afed7e0dc22c7e9e02b082a5221da158a Mon Sep 17 00:00:00 2001 From: Rory& Date: Wed, 6 May 2026 20:21:03 +0200 Subject: [PATCH] Security: check bot ownership when resetting token --- .../applications/#application_id/bot/index.ts | 16 ++++++++-------- src/util/entities/Application.ts | 4 ++++ 2 files changed, 12 insertions(+), 8 deletions(-) diff --git a/src/api/routes/applications/#application_id/bot/index.ts b/src/api/routes/applications/#application_id/bot/index.ts index c25649bbd..f37792db8 100644 --- a/src/api/routes/applications/#application_id/bot/index.ts +++ b/src/api/routes/applications/#application_id/bot/index.ts @@ -66,18 +66,18 @@ router.post( }, }), async (req: Request, res: Response) => { - const bot = await User.findOneOrFail({ where: { id: req.params.application_id as string, bot: true } }); - const owner = req.user; + const botApplication = await Application.findOneOrFail({ where: { id: req.params.application_id as string }, relations: { bot: true } }); - if (owner.id != req.user_id) throw DiscordApiErrors.ACTION_NOT_AUTHORIZED_ON_APPLICATION; + // TODO: handle teams + if (botApplication.owner_id != req.user_id) throw DiscordApiErrors.ACTION_NOT_AUTHORIZED_ON_APPLICATION; - if (owner.totp_secret && (!req.body.code || verifyToken(owner.totp_secret, req.body.code))) throw new HTTPError(req.t("auth:login.INVALID_TOTP_CODE"), 60008); + const botOwner = await User.findOneOrFail({ where: { id: botApplication.owner_id } }); + if (botOwner.totp_secret && (!req.body.code || verifyToken(botOwner.totp_secret, req.body.code))) throw new HTTPError(req.t("auth:login.INVALID_TOTP_CODE"), 60008); - bot.data = { hash: undefined, valid_tokens_since: new Date() }; + botApplication.bot!.data = { hash: undefined, valid_tokens_since: new Date() }; + await botApplication.bot!.save(); - await bot.save(); - - const token = await generateToken(bot.id); + const token = await generateToken(botApplication.id); res.json({ token }).status(200); }, diff --git a/src/util/entities/Application.ts b/src/util/entities/Application.ts index c4f403436..8b857f145 100644 --- a/src/util/entities/Application.ts +++ b/src/util/entities/Application.ts @@ -57,6 +57,10 @@ export class Application extends BaseClass { @ManyToOne(() => User, { onDelete: "CASCADE" }) owner: User; + @Column() + @RelationId((application: Application) => application.owner) + owner_id: string; + // TODO: enum this? https://discord.com/developers/docs/resources/application#application-object-application-flags @Column() flags: number = 0;