Assert that requesting user is a member of (group/) DM before allowing them to add members

1 files changed, 4 insertions, 0 deletions

diff --git a/src/api/routes/channels/#channel_id/recipients.ts b/src/api/routes/channels/#channel_id/recipients.ts

index 72ac12f7f..78cce3c72 100644
--- a/src/api/routes/channels/#channel_id/recipients.ts
+++ b/src/api/routes/channels/#channel_id/recipients.ts
@@ -39,6 +39,10 @@ router.put(
             relations: { recipients: true },
         });
 
+        if (!channel.recipients || channel.recipients.length == 0 || channel.recipients.filter((r) => r.user_id == req.user_id).length == 0) {
+            throw DiscordApiErrors.UNKNOWN_CHANNEL; // TODO: is this the right error
+        }
+
         if (channel.type !== ChannelType.GROUP_DM) {
             const recipients = [...new Set([...(channel.recipients?.map((r) => r.user_id) || []), user_id])];