mythic-insight/calcom
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 5

Fix update event type authorization (#2588)

Browse source
This commit is contained in:
Afzal Sayed 2022-04-25 02:32:04 +05:30 committed by GitHub
parent 2c4a891a89
commit 53d7e57142
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 15 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
apps/web/server/routers/viewer/eventTypes.tsx
View file

@ -193,6 +193,21 @@ export const eventTypesRouter = createProtectedRouter()
throw new TRPCError({ code: "UNAUTHORIZED" });
}
const inputUsers = (rawInput as any).users || [];
const isAllowed = (function () {
if (event.team) {
const allTeamMembers = event.team.members.map((member) => member.userId);
return inputUsers.every((userId: string) => allTeamMembers.includes(Number.parseInt(userId)));
}
return inputUsers.every((userId: string) => Number.parseInt(userId) === ctx.user.id);
})();
if (!isAllowed) {
console.warn(`User ${ctx.user.id} attempted to an create an event for users ${inputUsers.join(", ")}.`);
throw new TRPCError({ code: "FORBIDDEN" });
}
return next();
})
.mutation("update", {