Security: ensure that a bot user is infact a bot when requesting a token reset

1 files changed, 1 insertions, 1 deletions

diff --git a/src/api/routes/applications/#application_id/bot/index.ts b/src/api/routes/applications/#application_id/bot/index.ts

index a5eb3127..c25649bb 100644
--- a/src/api/routes/applications/#application_id/bot/index.ts
+++ b/src/api/routes/applications/#application_id/bot/index.ts
@@ -66,7 +66,7 @@ router.post(
         },
     }),
     async (req: Request, res: Response) => {
-        const bot = await User.findOneOrFail({ where: { id: req.params.application_id as string } });
+        const bot = await User.findOneOrFail({ where: { id: req.params.application_id as string, bot: true } });
         const owner = req.user;
 
         if (owner.id != req.user_id) throw DiscordApiErrors.ACTION_NOT_AUTHORIZED_ON_APPLICATION;