From 36aaaf8d920b9d773f8499e9cbf05ec0589f25c5 Mon Sep 17 00:00:00 2001 From: Kyren223 Date: Mon, 13 Jan 2025 19:02:19 +0200 Subject: Fixed security vulnerability where you could read "no access" frequencies even if you were a normal user and not an admin --- internal/server/api/api.go | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'internal/server/api') diff --git a/internal/server/api/api.go b/internal/server/api/api.go index 588e81f..9a0ef76 100644 --- a/internal/server/api/api.go +++ b/internal/server/api/api.go @@ -124,8 +124,7 @@ func RequestMessages(ctx context.Context, sess *session.Session, request *packet return &ErrPermissionDenied } - if frequency.Perms == packet.PermNoAccess && !member.IsMember { - log.Println("No perms") + if frequency.Perms == packet.PermNoAccess && !member.IsAdmin { return &ErrPermissionDenied } -- cgit v1.3.1