SECURITY: Prevent changing other servers' settings

Kenny2github · Jan 2, 2023 · a947d7c · a947d7c
1 parent a5e1ac9
commit a947d7c
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/kenny2automate/server/__init__.py b/kenny2automate/server/__init__.py
@@ -576,6 +576,9 @@ async def save_server(self, request):
             param['ping'] = '|'.join(param.get('ping', ())) or None
             params.append(param)
         otherparams['guild_id'] = guild.id
+        if set(param['channel_id'] for param in params) \
+                - set(channel.id for channel in guild.channels): # is not empty
+            raise web.HTTPBadRequest
         try:
             with self.db.connection:
                 self.db.executemany(