jmug/stoatchat
1
0
Fork 1
mirror of https://github.com/stoatchat/stoatchat.git synced 2026-07-14 05:26:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: add elevation check to role edit route

Browse Source
This commit is contained in:
Paul Makles
2024-04-07 15:52:14 +01:00
parent 54a4eff623
commit aded2e3239
3 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
crates/delta/src/routes/servers/permissions_set.rs
View File

@@ -36,10 +36,12 @@ pub async fn req(
.throw_permission(db, Permission::ManagePermissions)
.await?;
// Prevent us from editing roles above us
if rank <= permissions.get_member_rank().unwrap_or(i64::MIN) {
return Err(Error::NotElevated);
}
// Ensure we have access to grant these permissions forwards
let current_value: Override = current_value.into();
permissions
.throw_permission_override(db, current_value, data.permissions)

1
crates/delta/src/routes/servers/permissions_set_default.rs
View File

@@ -24,6 +24,7 @@ pub async fn req(
.throw_permission(db, Permission::ManagePermissions)
.await?;
// Ensure we have permissions to grant these permissions forwards
permissions
.throw_permission_value(db, data.permissions)
.await?;

6
crates/delta/src/routes/servers/roles_edit.rs
View File

@@ -58,6 +58,11 @@ pub async fn req(
let member_rank = permissions.get_member_rank().unwrap_or(i64::MIN);
if let Some(mut role) = server.roles.remove(&role_id) {
// Prevent us from editing roles above us
if role.rank <= member_rank {
return Err(Error::NotElevated);
}
let DataEditRole {
name,
colour,
@@ -66,6 +71,7 @@ pub async fn req(
remove,
} = data;
// Prevent us from moving a role above other roles
if let Some(rank) = &rank {
if rank <= &member_rank {
return Err(Error::NotElevated);