mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
jevb
57d87bb439
Private attachments were accessible without authentication if the UUID
was known. Added AuthMiddleware to the GET /api/v1/files/{id} route,
uploader_id tracking on uploads, and channel-level permission checks
(guild READ_MESSAGES, DM participant, admin bypass) in handleServeFile.
Migration 010 adds uploader_id column to attachments table.
8 new access-control tests covering all authorization paths.
4 lines
239 B
SQL
4 lines
239 B
SQL
-- Migration 010: Add uploader_id to attachments for ownership checks (BUG-092).
|
|
ALTER TABLE attachments ADD COLUMN uploader_id INTEGER REFERENCES users(id);
|
|
CREATE INDEX IF NOT EXISTS idx_attachments_uploader ON attachments(uploader_id);
|