HMC/handmade-revolt-backend
6
0
Fork 0
forked from jmug/stoatchat
Code Pull Requests Actions Packages Releases 2 Activity

restrict webhooks to text and group dm channels

Browse Source
This commit is contained in:
Zomatree
2023-04-25 20:30:16 +01:00
parent 57f00a283b
commit 8c5de18991
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
crates/delta/src/routes/channels/webhook_create.rs
View File

@@ -1,4 +1,4 @@
use revolt_quark::{models::{User, Webhook, File}, perms, Db, Error, Permission, Ref, Result}; use revolt_quark::{models::{User, Webhook, File, Channel}, perms, Db, Error, Permission, Ref, Result};
use rocket::serde::json::Json; use rocket::serde::json::Json;
use serde::{Deserialize, Serialize}; use serde::{Deserialize, Serialize};
use ulid::Ulid; use ulid::Ulid;
@@ -24,6 +24,11 @@ pub async fn req(db: &Db, user: User, target: Ref, data: Json<CreateWebhookBody>
.map_err(|error| Error::FailedValidation { error })?; .map_err(|error| Error::FailedValidation { error })?;
let channel = target.as_channel(db).await?; let channel = target.as_channel(db).await?;
if !matches!(channel, Channel::TextChannel { .. } | Channel::Group { .. }) {
return Err(Error::InvalidOperation)
}
let mut permissions = perms(&user).channel(&channel); let mut permissions = perms(&user).channel(&channel);
permissions permissions
.has_permission(db, Permission::ManageWebhooks) .has_permission(db, Permission::ManageWebhooks)