From 593c3fb72016600ecb08d4993155c1ebcb3a8d83 Mon Sep 17 00:00:00 2001 From: NikoCat233 Date: Wed, 22 Jul 2026 15:58:56 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E9=82=AE=E4=BB=B6=E8=AF=A6?= =?UTF-8?q?=E6=83=85=E4=B8=8E=E8=A7=84=E5=88=99=E6=9B=B4=E6=96=B0=E7=9A=84?= =?UTF-8?q?=E6=B0=B4=E5=B9=B3=E8=B6=8A=E6=9D=83=E6=BC=8F=E6=B4=9E=20(#351)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(auth): enforce email detail ownership * fix(rules): scope updates to owning user --- server/controllers/rule.go | 2 +- server/services/detail/detail.go | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/server/controllers/rule.go b/server/controllers/rule.go index 757408b..bca4b4b 100644 --- a/server/controllers/rule.go +++ b/server/controllers/rule.go @@ -61,7 +61,7 @@ func UpsertRule(ctx *context.Context, w http.ResponseWriter, req *http.Request) func save(ctx *context.Context, p *models.Rule) error { if p.Id > 0 { - _, err := db.Instance.Exec(db.WithContext(ctx, "update rule set name=? ,value = ? ,action = ?,params = ?,sort = ? where id = ?"), p.Name, p.Value, p.Action, p.Params, p.Sort, p.Id) + _, err := db.Instance.Exec(db.WithContext(ctx, "update rule set name=? ,value = ? ,action = ?,params = ?,sort = ? where id = ? and user_id = ?"), p.Name, p.Value, p.Action, p.Params, p.Sort, p.Id, ctx.UserID) if err != nil { return errors.Wrap(err) } diff --git a/server/services/detail/detail.go b/server/services/detail/detail.go index 2a73e0d..2c47bdc 100644 --- a/server/services/detail/detail.go +++ b/server/services/detail/detail.go @@ -20,7 +20,7 @@ import . "xorm.io/builder" func GetEmailDetail(ctx *context.Context, id int, markRead bool) (*response.EmailResponseData, error) { // 先查是否是本人的邮件 var ue models.UserEmail - _, err := db.Instance.Where("email_id = ?", id).Get(&ue) + _, err := db.Instance.Where("email_id = ? AND user_id = ?", id, ctx.UserID).Get(&ue) if err != nil { log.Error(err) }