Merge pull request #734 from MaddyUnderStars/fix/sanitisation

Fix users arbitrarily editing their own User object, and disallow sending messages to certain channels ( eg categories )

1 files changed, 1 insertions, 2 deletions

diff --git a/api/src/routes/users/@me/index.ts b/api/src/routes/users/@me/index.ts

index d32b44f9..1af413c4 100644
--- a/api/src/routes/users/@me/index.ts
+++ b/api/src/routes/users/@me/index.ts
@@ -46,8 +46,6 @@ router.patch("/", route({ body: "UserModifySchema" }), async (req: Request, res:
 		}
 	}
 
-	user.assign(body);
-
 	if (body.new_password) {
 		if (!body.password && !user.email) {
 			throw FieldErrors({
@@ -66,6 +64,7 @@ router.patch("/", route({ body: "UserModifySchema" }), async (req: Request, res:
         }
     }
 
+	user.assign(body);
 	await user.save();
 
 	// @ts-ignore