diff options
| author | Madeline <46743919+MaddyUnderStars@users.noreply.github.com> | 2023-02-03 14:39:42 +1100 |
|---|---|---|
| committer | Madeline <46743919+MaddyUnderStars@users.noreply.github.com> | 2023-02-03 14:39:42 +1100 |
| commit | 583b271ba2dc80e4d83b2453a84f0d7368e26635 (patch) | |
| tree | c10505b71a2e78ff75dc251610993cd9525be4c5 /src/api/routes/channels/#channel_id | |
| parent | Merge pull request from GHSA-9qvc-84ch-5p2x (diff) | |
| download | server-583b271ba2dc80e4d83b2453a84f0d7368e26635.tar.xz | |
Don't allow message types to be edited
Diffstat (limited to 'src/api/routes/channels/#channel_id')
| -rw-r--r-- | src/api/routes/channels/#channel_id/messages/#message_id/index.ts | 9 |
1 files changed, 3 insertions, 6 deletions
diff --git a/src/api/routes/channels/#channel_id/messages/#message_id/index.ts b/src/api/routes/channels/#channel_id/messages/#message_id/index.ts index 95230478..400b8f3a 100644 --- a/src/api/routes/channels/#channel_id/messages/#message_id/index.ts +++ b/src/api/routes/channels/#channel_id/messages/#message_id/index.ts @@ -30,6 +30,7 @@ import { Snowflake, uploadFile, MessageCreateSchema, + MessageEditSchema, } from "@fosscord/util"; import { Router, Response, Request } from "express"; import multer from "multer"; @@ -52,13 +53,13 @@ const messageUpload = multer({ router.patch( "/", route({ - body: "MessageCreateSchema", + body: "MessageEditSchema", permission: "SEND_MESSAGES", right: "SEND_MESSAGES", }), async (req: Request, res: Response) => { const { message_id, channel_id } = req.params; - let body = req.body as MessageCreateSchema; + let body = req.body as MessageEditSchema; const message = await Message.findOneOrFail({ where: { id: message_id, channel_id }, @@ -81,10 +82,6 @@ router.patch( } } else rights.hasThrow("SELF_EDIT_MESSAGES"); - // The permision should obviously not allow editing the message type - // But for people with the right, does this make sense? - if (body.type) rights.hasThrow("MANAGE_MESSAGES"); - const new_message = await handleMessage({ ...message, // TODO: should message_reference be overridable? |