Security: Dont allow other users to manage application commands

2 files changed, 13 insertions, 0 deletions

diff --git a/src/api/routes/applications/#application_id/commands/#command_id/index.ts b/src/api/routes/applications/#application_id/commands/#command_id/index.ts

index e0618613..e32399a6 100644
--- a/src/api/routes/applications/#application_id/commands/#command_id/index.ts
+++ b/src/api/routes/applications/#application_id/commands/#command_id/index.ts
@@ -61,6 +61,10 @@ router.patch(
             return;
         }
 
+        if (req.user_id != req.params.application_id) {
+            res.status(401).send({ code: 401, message: "You are not this application" });
+        }
+
         const body = req.body as ApplicationCommandCreateSchema;
 
         if (!body.type) {
@@ -115,6 +119,11 @@ router.delete("/", route({}), async (req: Request, res: Response) => {
         return;
     }
 
+    if (req.user_id != req.params.application_id) {
+        res.status(401).send({ code: 401, message: "You are not this application" });
+    }
+
+
     await ApplicationCommand.delete({ application_id: req.params.application_id as string, id: req.params.command_id as string });
     res.sendStatus(204);
 });
diff --git a/src/api/routes/applications/#application_id/commands/index.ts b/src/api/routes/applications/#application_id/commands/index.ts

index a3aaec2f..1aa70890 100644
--- a/src/api/routes/applications/#application_id/commands/index.ts
+++ b/src/api/routes/applications/#application_id/commands/index.ts
@@ -49,6 +49,10 @@ router.post(
             return;
         }
 
+        if (req.user_id != req.params.application_id) {
+            res.status(401).send({ code: 401, message: "You are not this application" });
+        }
+
         const body = req.body as ApplicationCommandCreateSchema;
 
         if (!body.type) {