diff --git a/src/database/entities/channel.rs b/src/database/entities/channel.rs index 5138793bf99d0aefbd51e006b66b08ebb08f2d60..4c8d69e6f037a596c2c0bccbffe64b0e807d8da1 100644 --- a/src/database/entities/channel.rs +++ b/src/database/entities/channel.rs @@ -6,7 +6,7 @@ use rocket_contrib::json::JsonValue; use serde::{Deserialize, Serialize}; #[derive(Serialize, Deserialize, Debug, Clone)] -#[serde(tag = "type")] +#[serde(tag = "channel_type")] pub enum Channel { SavedMessages { #[serde(rename = "_id")] diff --git a/src/database/guards/reference.rs b/src/database/guards/reference.rs index 829ff244e2bd8d4ec7fc4b4221066cf403ad7b47..65e0dfbe3cf215911768cbd3563b4fd5ed284d11 100644 --- a/src/database/guards/reference.rs +++ b/src/database/guards/reference.rs @@ -47,8 +47,13 @@ impl Ref { self.fetch("channels").await } - pub async fn fetch_message(&self) -> Result<Message> { - self.fetch("messages").await + pub async fn fetch_message(&self, channel: &Channel) -> Result<Message> { + let message: Message = self.fetch("messages").await?; + if &message.channel != channel.id() { + Err(Error::InvalidOperation) + } else { + Ok(message) + } } } diff --git a/src/routes/channels/message_delete.rs b/src/routes/channels/message_delete.rs index f47c635935754ff0724e41140073f5333a226543..67b88dc82da8cd4d5dbaa780f2c386b6abf04606 100644 --- a/src/routes/channels/message_delete.rs +++ b/src/routes/channels/message_delete.rs @@ -12,7 +12,7 @@ pub async fn req(user: User, target: Ref, msg: Ref) -> Result<()> { Err(Error::LabelMe)? } - let message = msg.fetch_message().await?; + let message = msg.fetch_message(&channel).await?; if message.author != user.id && !perm.get_manage_messages() { match channel { Channel::SavedMessages { .. } => unreachable!(), diff --git a/src/routes/channels/message_edit.rs b/src/routes/channels/message_edit.rs index 10bed645f79f26732efc36086a67b694ca99e9e4..5f170cd5d471f262f7b0987b6a1e72d3580d0633 100644 --- a/src/routes/channels/message_edit.rs +++ b/src/routes/channels/message_edit.rs @@ -25,7 +25,7 @@ pub async fn req(user: User, target: Ref, msg: Ref, edit: Json<Data>) -> Result< Err(Error::LabelMe)? } - let message = msg.fetch_message().await?; + let message = msg.fetch_message(&channel).await?; if message.author != user.id { Err(Error::CannotEditMessage)? } diff --git a/src/routes/channels/message_fetch.rs b/src/routes/channels/message_fetch.rs index 887a68a2aa2ae6e41bc21f15a3bd5a77e1e39e01..7b4ff9337b0fb1b44da143216244c07c0254270a 100644 --- a/src/routes/channels/message_fetch.rs +++ b/src/routes/channels/message_fetch.rs @@ -12,6 +12,6 @@ pub async fn req(user: User, target: Ref, msg: Ref) -> Result<JsonValue> { Err(Error::LabelMe)? } - let message = msg.fetch_message().await?; + let message = msg.fetch_message(&channel).await?; Ok(json!(message)) }