From 278d795d50255e40bb105034e2fe3fe1694966bd Mon Sep 17 00:00:00 2001
From: Paul Makles <paulmakles@gmail.com>
Date: Fri, 29 Apr 2022 13:07:33 +0100
Subject: [PATCH] fix: don't allow mutual route if self

---
 src/routes/users/find_mutual.rs | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/routes/users/find_mutual.rs b/src/routes/users/find_mutual.rs
index 202720d5..dab8ee7c 100644
--- a/src/routes/users/find_mutual.rs
+++ b/src/routes/users/find_mutual.rs
@@ -22,6 +22,10 @@ pub struct MutualResponse {
 pub async fn req(db: &State<Database>, user: User, target: Ref) -> Result<Json<MutualResponse>> {
     let target = target.as_user(db).await?;
 
+    if target.id == user.id {
+        return Err(Error::InvalidOperation);
+    }
+
     if perms(&user)
         .user(&target)
         .calc_user(db)