修复邮件详情与规则更新的水平越权漏洞 (#351)

* fix(auth): enforce email detail ownership

* fix(rules): scope updates to owning user

server/controllers/rule.go

@@ -61,7 +61,7 @@ func UpsertRule(ctx *context.Context, w http.ResponseWriter, req *http.Request)
 func save(ctx *context.Context, p *models.Rule) error {
 
 	if p.Id > 0 {
-		_, err := db.Instance.Exec(db.WithContext(ctx, "update rule set name=? ,value = ? ,action = ?,params = ?,sort = ? where id = ?"), p.Name, p.Value, p.Action, p.Params, p.Sort, p.Id)
+		_, err := db.Instance.Exec(db.WithContext(ctx, "update rule set name=? ,value = ? ,action = ?,params = ?,sort = ? where id = ? and user_id = ?"), p.Name, p.Value, p.Action, p.Params, p.Sort, p.Id, ctx.UserID)
 		if err != nil {
 			return errors.Wrap(err)
 		}

server/services/detail/detail.go

@@ -20,7 +20,7 @@ import . "xorm.io/builder"
 func GetEmailDetail(ctx *context.Context, id int, markRead bool) (*response.EmailResponseData, error) {
 	// 先查是否是本人的邮件
 	var ue models.UserEmail
-	_, err := db.Instance.Where("email_id = ?", id).Get(&ue)
+	_, err := db.Instance.Where("email_id = ? AND user_id = ?", id, ctx.UserID).Get(&ue)
 	if err != nil {
 		log.Error(err)
 	}