Dekescordes/spacebar
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix private messages being returned when no channel_id provided in search

Browse Source
This commit is contained in:
Madeline 2022-12-05 19:29:50 +11:00
parent b380cf19ba
commit fbde8f978b
1 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
src/api/routes/guilds/#guild_id/messages/search.ts
View File

@ -1,8 +1,8 @@
import { Request, Response, Router } from "express"; import { Request, Response, Router } from "express";
import { route } from "@fosscord/api"; import { route } from "@fosscord/api";
import { getPermission, FieldErrors, Message } from "@fosscord/util"; import { getPermission, FieldErrors, Message, Channel } from "@fosscord/util";
import { HTTPError } from "lambert-server"; import { HTTPError } from "lambert-server";
import { FindManyOptions, Like } from "typeorm"; import { FindManyOptions, In, Like } from "typeorm";
const router: Router = Router(); const router: Router = Router();
@ -38,7 +38,7 @@ router.get("/", route({}), async (req: Request, res: Response) => {
const permissions = await getPermission( const permissions = await getPermission(
req.user_id, req.user_id,
req.params.guild_id, req.params.guild_id,
channel_id as string, channel_id as string | undefined,
); );
permissions.hasThrow("VIEW_CHANNEL"); permissions.hasThrow("VIEW_CHANNEL");
if (!permissions.has("READ_MESSAGE_HISTORY")) if (!permissions.has("READ_MESSAGE_HISTORY"))
@ -70,6 +70,20 @@ router.get("/", route({}), async (req: Request, res: Response) => {
}; };
//@ts-ignore //@ts-ignore
if (channel_id) query.where!.channel = { id: channel_id }; if (channel_id) query.where!.channel = { id: channel_id };
else {
// get all channel IDs that this user can access
const channels = await Channel.find({ where: { guild_id: req.params.guild_id }, select: ["id"] });
const ids = [];
for (var channel of channels) {
const perm = await getPermission(req.user_id, req.params.guild_id, channel.id);
if (!perm.has("VIEW_CHANNEL") || !perm.has("READ_MESSAGE_HISTORY")) continue;
ids.push(channel.id);
}
//@ts-ignore
query.where!.channel = { id: In(ids) };
}
//@ts-ignore //@ts-ignore
if (author_id) query.where!.author = { id: author_id }; if (author_id) query.where!.author = { id: author_id };
//@ts-ignore //@ts-ignore