fix: forbid poll editing/creating in non-text channels

3 files changed, 11 insertions, 0 deletions

diff --git a/src/api/routes/channels/#channel_id/messages/#message_id/index.ts b/src/api/routes/channels/#channel_id/messages/#message_id/index.ts

index 98ed53fb..8285dc04 100644
--- a/src/api/routes/channels/#channel_id/messages/#message_id/index.ts
+++ b/src/api/routes/channels/#channel_id/messages/#message_id/index.ts
@@ -32,6 +32,7 @@ import {
     getRights,
     uploadFile,
     NewUrlUserSignatureData,
+    DiscordApiErrors,
 } from "@spacebar/util";
 import { MessageCreateAttachment, MessageCreateCloudAttachment, MessageCreateSchema, MessageEditSchema, ChannelType } from "@spacebar/schemas";
 
@@ -85,6 +86,10 @@ router.patch(
             }
         } else rights.hasThrow("SELF_EDIT_MESSAGES");
 
+        if (message.poll) {
+            throw DiscordApiErrors.POLL_CANNOT_EDIT_MESSAGE;
+        }
+
         // no longer necessary, somehow resolved by updating the type of `attachments`...?
         // //@ts-expect-error Something is wrong with message_reference here, TS complains since "channel_id" is optional in MessageCreateSchema
         const new_message = await handleMessage({
diff --git a/src/api/routes/channels/#channel_id/messages/index.ts b/src/api/routes/channels/#channel_id/messages/index.ts

index 43fb8f9b..c9d266ee 100644
--- a/src/api/routes/channels/#channel_id/messages/index.ts
+++ b/src/api/routes/channels/#channel_id/messages/index.ts
@@ -355,6 +355,10 @@ router.post(
             throw new HTTPError(`Cannot send messages to channel of type ${channel.type}`, 400);
         }
 
+        if (body.poll && !isTextChannel(channel.type)) {
+            throw DiscordApiErrors.POLL_INVALID_CHANNEL_TYPE;
+        }
+
         // handle blocked users in dms
         if (channel.recipients?.length == 2) {
             const otherUser = channel.recipients.find((r) => r.user_id != req.user_id)?.user;
diff --git a/src/util/util/Constants.ts b/src/util/util/Constants.ts

index 4ffe9d12..b605d1a9 100644
--- a/src/util/util/Constants.ts
+++ b/src/util/util/Constants.ts
@@ -661,6 +661,8 @@ export const DiscordApiErrors = {
     BULK_BAN_FAILED: new ApiError("Failed to ban users", 500000),
     POLL_VOTING_BLOCKED: new ApiError("Poll voting blocked", 520000),
     POLL_EXPIRED: new ApiError("Poll expired", 520001),
+    POLL_INVALID_CHANNEL_TYPE: new ApiError("Invalid channel type for poll creation", 520002),
+    POLL_CANNOT_EDIT_MESSAGE: new ApiError("Cannot edit a poll message", 520003),
 
     //Other errors
     UNKNOWN_VOICE_STATE: new ApiError("Unknown Voice State", 10065, 404),