dandri/server
1
0 Fork 0
mirror of https://github.com/spacebarchat/server.git synced 2026-10-22 19:43:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Restrict reading of application emojis

Browse Source
This commit is contained in:
Rory& committed 2026-07-01 19:30:20 +02:00
1 parent 5f76f5f4af
commit e3ef9c5216
1 file changed
+7 -1
Download Patch File Download Diff File Expand all files Collapse all files
src/api/routes/applications/#application_id/emojis.ts
+7 -1
View File
@@ -39,7 +39,9 @@ router.get(
async (req: Request, res: Response) => {
const { application_id } = req.params as { [key: string]: string };
// TODO: is there *any* gating on this endpoint?
const app = await Application.findOne({ where: { id: application_id } });
if (!app) throw DiscordApiErrors.UNKNOWN_APPLICATION;
if (req.user_id != app?.id && req.user_id != app?.owner_id) throw DiscordApiErrors.ACTION_NOT_AUTHORIZED_ON_APPLICATION;
const emojis = await Emoji.find({
where: { application_id: application_id },
@@ -68,6 +70,10 @@ router.get(
async (req: Request, res: Response) => {
const { application_id, emoji_id } = req.params as { [key: string]: string };
const app = await Application.findOne({ where: { id: application_id } });
if (!app) throw DiscordApiErrors.UNKNOWN_APPLICATION;
if (req.user_id != app?.id && req.user_id != app?.owner_id) throw DiscordApiErrors.ACTION_NOT_AUTHORIZED_ON_APPLICATION;
const emoji = await Emoji.findOneOrFail({
where: { application_id: application_id, id: emoji_id },
relations: { user: true },