Fix arbitrary access to reminder list.

2023-07-23 14:29:59 +01:00
parent 4a17aac15c
commit 01dc0334fd
2 changed files with 18 additions and 2 deletions
--- a/web/src/routes/dashboard/guild.rs
+++ b/web/src/routes/dashboard/guild.rs
@ -311,7 +311,15 @@ pub async fn create_guild_reminder(
 }

 #[get("/api/guild/<id>/reminders")]
-pub async fn get_reminders(id: u64, ctx: &State<Context>, pool: &State<Pool<MySql>>) -> JsonResult {
+pub async fn get_reminders(
+    id: u64,
+    cookies: &CookieJar<'_>,
+    ctx: &State<Context>,
+    serenity_context: &State<Context>,
+    pool: &State<Pool<MySql>>,
+) -> JsonResult {
+    check_authorization!(cookies, serenity_context.inner(), id);
+
    let channels_res = GuildId(id).channels(&ctx.inner()).await;

    match channels_res {