From 8c5de18991f26bef7182a6da819105975f17568d Mon Sep 17 00:00:00 2001 From: Zomatree Date: Tue, 25 Apr 2023 20:30:16 +0100 Subject: [PATCH] restrict webhooks to text and group dm channels --- crates/delta/src/routes/channels/webhook_create.rs | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/crates/delta/src/routes/channels/webhook_create.rs b/crates/delta/src/routes/channels/webhook_create.rs index 8e5e2d34..7d2bafbb 100644 --- a/crates/delta/src/routes/channels/webhook_create.rs +++ b/crates/delta/src/routes/channels/webhook_create.rs @@ -1,4 +1,4 @@ -use revolt_quark::{models::{User, Webhook, File}, perms, Db, Error, Permission, Ref, Result}; +use revolt_quark::{models::{User, Webhook, File, Channel}, perms, Db, Error, Permission, Ref, Result}; use rocket::serde::json::Json; use serde::{Deserialize, Serialize}; use ulid::Ulid; @@ -24,6 +24,11 @@ pub async fn req(db: &Db, user: User, target: Ref, data: Json .map_err(|error| Error::FailedValidation { error })?; let channel = target.as_channel(db).await?; + + if !matches!(channel, Channel::TextChannel { .. } | Channel::Group { .. }) { + return Err(Error::InvalidOperation) + } + let mut permissions = perms(&user).channel(&channel); permissions .has_permission(db, Permission::ManageWebhooks)