kyush/misskey
1
0
Fork 0
forked from mirrors/misskey
Code Pull requests Projects Releases Packages 1 Activity Actions

Merge commit from fork

Browse source 
This issue was originally reported by sururu-k as part of a series of ai slop public pull requests.
Although the original pull request was closed as ai slop, I later confirmed one described a real security issue.
This commit is contained in:
anatawa12 2026-05-21 08:50:43 +09:00 • committed by GitHub
commit 3191f8a72d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 5 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

9
packages/backend/src/core/AnnouncementService.ts
View file

@ -182,11 +182,12 @@ export class AnnouncementService {
@bindThis
public async getAnnouncement(announcementId: MiAnnouncement['id'], me: MiUser | null): Promise<Packed<'Announcement'>> {
const announcement = await this.announcementsRepository.findOneByOrFail({ id: announcementId });
if (me) {
if (announcement.userId && announcement.userId !== me.id) {
throw new EntityNotFoundError(this.announcementsRepository.metadata.target, { id: announcementId });
}
if (announcement.userId && (me == null || announcement.userId !== me.id)) {
throw new EntityNotFoundError(this.announcementsRepository.metadata.target, { id: announcementId });
}
if (me) {
const read = await this.announcementReadsRepository.findOneBy({
announcementId: announcement.id,
userId: me.id,