diff options
| author | Fuwn <[email protected]> | 2026-04-18 08:55:15 +0000 |
|---|---|---|
| committer | Fuwn <[email protected]> | 2026-04-18 08:55:15 +0000 |
| commit | 92bf3d609699ebd810cfb770077c0f7714ee3119 (patch) | |
| tree | 5c3f66c5d88f1242a7c9987964535dff2d8501c3 /src/lib/User/BadgeWall | |
| parent | fix(api): encode subsplease timezone to prevent query-param injection (diff) | |
| download | due.moe-92bf3d609699ebd810cfb770077c0f7714ee3119.tar.xz due.moe-92bf3d609699ebd810cfb770077c0f7714ee3119.zip | |
fix(api): gate badge click-count on Origin and fix 401 response reuse
The PUT ?incrementClickCount path ran before any auth guard, letting
unauthenticated callers spam-increment arbitrary badges. Require the
request Origin to match appOrigin() so legitimate in-browser clicks
(authenticated or not) still count while direct scripted calls are
rejected.
Also convert the shared `unauthorised` Response singleton into a
factory. The singleton's body was consumed on first use, so subsequent
401 paths returned a `Response body is locked` error instead of the
intended "Unauthorised" body.
Diffstat (limited to 'src/lib/User/BadgeWall')
0 files changed, 0 insertions, 0 deletions