Ryan/drop
1
0
Fork 0
mirror of https://github.com/Drop-OSS/drop.git synced 2025-11-10 04:22:09 +10:00
Code Issues Packages Projects Releases Wiki Activity

fix: missing user check in screenshot api endpoint

Browse Source
This commit is contained in:
Huskydog9988
2025-05-15 18:28:08 -04:00
parent 4fbc730490
commit 21eec081ee
2 changed files with 23 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
server/api/v1/screenshots/[id]/index.delete.ts
View File

@ -13,5 +13,16 @@ export default defineEventHandler(async (h3) => {
statusMessage: "Missing screenshot ID",
});
return await screenshotManager.delete(screenshotId);
const result = await screenshotManager.get(screenshotId);
if (!result)
throw createError({
statusCode: 400,
statusMessage: "Incorrect screenshot ID",
});
else if (result.userId !== userId)
throw createError({
statusCode: 403,
});
await screenshotManager.delete(screenshotId);
});

12
server/api/v1/screenshots/[id]/index.get.ts
View File

@ -13,5 +13,15 @@ export default defineEventHandler(async (h3) => {
statusMessage: "Missing screenshot ID",
});
return await screenshotManager.get(screenshotId);
const result = await screenshotManager.get(screenshotId);
if (!result)
throw createError({
statusCode: 400,
statusMessage: "Incorrect screenshot ID",
});
else if (result.userId !== userId)
throw createError({
statusCode: 403,
});
return result;
});