fix: missing user check in screenshot api endpoint

server/api/v1/screenshots/[id]/index.delete.ts

@@ -13,5 +13,16 @@ export default defineEventHandler(async (h3) => {
       statusMessage: "Missing screenshot ID",
     });
 
-  return await screenshotManager.delete(screenshotId);
+  const result = await screenshotManager.get(screenshotId);
+  if (!result)
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Incorrect screenshot ID",
+    });
+  else if (result.userId !== userId)
+    throw createError({
+      statusCode: 403,
+    });
+
+  await screenshotManager.delete(screenshotId);
 });

server/api/v1/screenshots/[id]/index.get.ts

@@ -13,5 +13,15 @@ export default defineEventHandler(async (h3) => {
       statusMessage: "Missing screenshot ID",
     });
 
-  return await screenshotManager.get(screenshotId);
+  const result = await screenshotManager.get(screenshotId);
+  if (!result)
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Incorrect screenshot ID",
+    });
+  else if (result.userId !== userId)
+    throw createError({
+      statusCode: 403,
+    });
+  return result;
 });