From 17e52f812cc63910de9895b20c6b52b998a708db Mon Sep 17 00:00:00 2001 From: stefan080106 Date: Mon, 26 Apr 2021 21:16:29 +0200 Subject: :lock: Fix parent id checking --- src/routes/guilds/#guild_id/channels.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'src/routes') diff --git a/src/routes/guilds/#guild_id/channels.ts b/src/routes/guilds/#guild_id/channels.ts index d42ba481..19d466f3 100644 --- a/src/routes/guilds/#guild_id/channels.ts +++ b/src/routes/guilds/#guild_id/channels.ts @@ -31,8 +31,9 @@ router.post("/", check(ChannelModifySchema), async (req, res) => { } if (body.parent_id) { - const exists = ChannelModel.findOne({ channel_id: body.parent_id }).exec(); + const exists = await ChannelModel.findOne({ id: body.parent_id }, {guild_id:true}).exec(); if (!exists) throw new HTTPError("Parent id channel doesn't exist", 400); + if (exists.guild_id !== guild_id) throw new HTTPError("The category channel needs to be in the guild") } const guild = await GuildModel.findOne({ id: guild_id }, { id: true }).exec(); -- cgit 1.4.1