Dekescordes/spacebar
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #734 from MaddyUnderStars/fix/sanitisation

Browse Source 
Fix users arbitrarily editing their own User object, and disallow sending messages to certain channels ( eg categories )
This commit is contained in:
TheArcaneBrony 2022-04-22 18:12:18 +02:00 committed by GitHub
commit c160218fd2
5 changed files with 12495 additions and 8151 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20626
api/assets/schemas.json
View File

File diff suppressed because it is too large Load Diff

1
api/scripts/generate_schema.js
View File

@ -31,7 +31,6 @@ const Excluded = [
];
function modify(obj) {
delete obj.additionalProperties;
for (var k in obj) {
if (typeof obj[k] === "object" && obj[k] !== null) {
modify(obj[k]);

5
api/src/routes/channels/#channel_id/messages/index.ts
View File

@ -183,6 +183,9 @@ router.post(
}
}
const channel = await Channel.findOneOrFail({ where: { id: channel_id }, relations: ["recipients", "recipients.user"] });
if (!channel.isWritable()) {
throw new HTTPError(`Cannot send messages to channel of type ${channel.type}`, 400)
}
const embeds = body.embeds || [];
if (body.embed) embeds.push(body.embed);
@ -220,6 +223,8 @@ router.post(
})
);
}
//Fix for the client bug
delete message.member

3
api/src/routes/users/@me/index.ts
View File

@ -46,8 +46,6 @@ router.patch("/", route({ body: "UserModifySchema" }), async (req: Request, res:
}
}
user.assign(body);
if (body.new_password) {
if (!body.password && !user.email) {
throw FieldErrors({
@ -66,6 +64,7 @@ router.patch("/", route({ body: "UserModifySchema" }), async (req: Request, res:
}
}
user.assign(body);
await user.save();
// @ts-ignore

11
util/src/entities/Channel.ts
View File

@ -352,6 +352,17 @@ export class Channel extends BaseClass {
isDm() {
return this.type === ChannelType.DM || this.type === ChannelType.GROUP_DM;
}
// Does the channel support sending messages ( eg categories do not )
isWritable() {
const disallowedChannelTypes = [
ChannelType.GUILD_CATEGORY,
ChannelType.GUILD_VOICE, // TODO: Remove this when clients can send messages to voice channels on discord.com
ChannelType.GUILD_STAGE_VOICE,
ChannelType.VOICELESS_WHITEBOARD,
];
return disallowedChannelTypes.indexOf(this.type) == -1;
}
}
export interface ChannelPermissionOverwrite {