HMC/handmade-revolt-backend
6
0
Fork 0
forked from jmug/stoatchat
Code Pull Requests Actions Packages Releases 2 Activity

fix: ensure we have send perm to edit message

Browse Source
This commit is contained in:
Paul Makles
2023-03-04 11:18:18 +00:00
parent 6bd8221eda
commit fd80823910
1 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
crates/delta/src/routes/channels/message_edit.rs
View File

@@ -1,8 +1,9 @@
use revolt_quark::{ use revolt_quark::{
models::message::{PartialMessage, SendableEmbed}, models::message::{PartialMessage, SendableEmbed},
models::{Message, User}, models::{Message, User},
perms,
types::january::Embed, types::january::Embed,
Db, Error, Ref, Result, Timestamp, Db, Error, Permission, Ref, Result, Timestamp,
}; };
use rocket::serde::json::Json; use rocket::serde::json::Json;
@@ -28,7 +29,7 @@ pub struct DataEditMessage {
pub async fn req( pub async fn req(
db: &Db, db: &Db,
user: User, user: User,
target: String, target: Ref,
msg: Ref, msg: Ref,
edit: Json<DataEditMessage>, edit: Json<DataEditMessage>,
) -> Result<Json<Message>> { ) -> Result<Json<Message>> {
@@ -36,10 +37,17 @@ pub async fn req(
edit.validate() edit.validate()
.map_err(|error| Error::FailedValidation { error })?; .map_err(|error| Error::FailedValidation { error })?;
// Ensure we have permissions to send a message
let channel = target.as_channel(db).await?;
let mut permissions = perms(&user).channel(&channel);
permissions
.throw_permission_and_view_channel(db, Permission::SendMessage)
.await?;
Message::validate_sum(&edit.content, &edit.embeds)?; Message::validate_sum(&edit.content, &edit.embeds)?;
let mut message = msg.as_message(db).await?; let mut message = msg.as_message(db).await?;
if message.channel != target { if message.channel != channel.id() {
return Err(Error::NotFound); return Err(Error::NotFound);
} }