diff options
| author | Kyren223 <Kyren223@proton.me> | 2025-01-13 19:02:19 +0200 |
|---|---|---|
| committer | Kyren223 <Kyren223@proton.me> | 2025-01-13 19:02:19 +0200 |
| commit | 36aaaf8d920b9d773f8499e9cbf05ec0589f25c5 (patch) | |
| tree | abd87308df0f789d062ed3b803e469842d0fbe83 | |
| parent | 8f25e33d579f5d510495727b9f290d72733c4b85 (diff) | |
Fixed security vulnerability where you could read "no access"
frequencies even if you were a normal user and not an admin
| -rw-r--r-- | internal/server/api/api.go | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/internal/server/api/api.go b/internal/server/api/api.go index 588e81f..9a0ef76 100644 --- a/internal/server/api/api.go +++ b/internal/server/api/api.go @@ -124,8 +124,7 @@ func RequestMessages(ctx context.Context, sess *session.Session, request *packet return &ErrPermissionDenied } - if frequency.Perms == packet.PermNoAccess && !member.IsMember { - log.Println("No perms") + if frequency.Perms == packet.PermNoAccess && !member.IsAdmin { return &ErrPermissionDenied } |