security fix: disallow editing threads and posts by other users

ltheinrich · Feb 12, 2019 · a4af732 · a4af732
1 parent 2f1af2d
commit a4af732
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/internal/app/handlers/editpost.go b/internal/app/handlers/editpost.go
@@ -35,7 +35,8 @@ func EditPost(request map[string]interface{}, username string, auth bool) interf
 	}
 
 	// insert into database
-	_, err = db.DB.Exec("UPDATE posts SET content = $1 FROM users WHERE posts.id = $2 AND users.username = $3;",
+	_, err = db.DB.Exec(`UPDATE posts SET content = $1 FROM users
+						WHERE posts.author = users.id AND posts.id = $2 AND users.username = $3;`,
 		content, postID, username)
 	if err != nil {
 		// print and return error

diff --git a/internal/app/handlers/editthread.go b/internal/app/handlers/editthread.go
@@ -38,7 +38,7 @@ func EditThread(request map[string]interface{}, username string, auth bool) inte
 
 	// insert into database
 	_, err = db.DB.Exec(`UPDATE threads SET threadname = $1, content = $2 FROM users
-						WHERE threads.id = $3 AND users.username = $4;`,
+						WHERE threads.author = users.id AND threads.id = $3 AND users.username = $4;`,
 		title, content, threadID, username)
 	if err != nil {
 		// print and return error