diff options
| author | Fuwn <[email protected]> | 2026-06-01 15:11:27 +0000 |
|---|---|---|
| committer | Fuwn <[email protected]> | 2026-06-01 15:11:27 +0000 |
| commit | 7c49986a5646e892a115725abb43cf97b5d7c1d2 (patch) | |
| tree | ed842f6009cdd07f0ff890bfde3be90c49759970 /src/routes/tools/[tool]/+page.svelte | |
| parent | fix(badges): drop content-visibility that clipped tooltip and tilt (diff) | |
| download | due.moe-main.tar.xz due.moe-main.zip | |
PUT /api/badges?shadowHide=<userId> called setShadowHidden on an
arbitrary user_id with no ownership/privilege check, so any logged-in
user could flip shadow_hidden on another user's badges (e.g. un-hide
moderator-hidden ones). The GraphQL path already guarded this; the REST
twin didn't. Extract the owner-or-privileged check into a shared
isOwnerOrPrivileged helper, use it in both the REST endpoint and the
GraphQL resolver, and add a regression test.
Diffstat (limited to 'src/routes/tools/[tool]/+page.svelte')
0 files changed, 0 insertions, 0 deletions