Security patches (thanks @Jvr2022)

Author: andr3i1010

src/utils/auth/ban.ts

@@ -16,7 +16,14 @@ async function sendDiscordEmbed(embed: Embed) {
 }
 
 export async function banUserPlatform(userId: string, banReason: string, banEnd?: string) {
+    const operator = await getUserFromSession()
+    if (!operator) {
+        throw new Error('Not allowed')
+    }
     try {
+        if (operator.role !== "admin") {
+            return { success: false, error: 'Unauthorized' }
+        }
         const updateData: any = {
             loginAllowed: false,
             banReason: banReason
@@ -63,6 +70,10 @@ export async function banUserPlatform(userId: string, banReason: string, banEnd?
 }
 
 export async function banUserForum(userId: string, banReason: string, banEnd?: string) {
+    const operator = await getUserFromSession()
+    if (!operator || !(operator.role !== "admin")) {
+        return { success: false, error: 'Unauthorized' }
+    }
     try {
         const updateData: any = {
             forumAllowed: false,
@@ -99,6 +110,10 @@ export async function banUserForum(userId: string, banReason: string, banEnd?: s
     }
 }
 export async function unbanUserPlatform(userId: string) {
+    const operator = await getUserFromSession()
+    if (!operator || !(operator.role !== "admin")) {
+        return { success: false, error: 'Unauthorized' }
+    }
     try {
         await prisma.user.update({
             where: {
@@ -131,6 +146,10 @@ export async function unbanUserPlatform(userId: string) {
     }
 }
 export async function unbanUserForum(userId: string) {
+    const operator = await getUserFromSession()
+    if (!operator || !(operator.role !== "admin")) {
+        return { success: false, error: 'Unauthorized' }
+    }
     try {
         await prisma.user.update({
             where: {

src/utils/auth/user.ts

@@ -302,6 +302,10 @@ export async function createUserCredentials(
 }
 
 export async function resetUserPassword(userId: string): Promise<PasswordActionResult> {
+  const operator = await getUserFromSession()
+  if (!operator || !(operator.role !== "admin")) {
+    return { success: false, error: 'Unauthorized' }
+  }
   try {
     // Generate a random temporary password
     const tempPassword = crypto.randomBytes(8).toString('base64');
@@ -345,6 +349,10 @@ export async function resetUserPassword(userId: string): Promise<PasswordActionR
 }
 
 export async function setCustomPassword(userId: string, password: string): Promise<PasswordActionResult> {
+  const operator = await getUserFromSession()
+  if (!operator || !(operator.role !== "admin")) {
+    return { success: false, error: 'Unauthorized' }
+  }
   try {
     const salt = crypto.randomBytes(16).toString("base64");
 
@@ -386,6 +394,10 @@ export async function setCustomPassword(userId: string, password: string): Promi
 }
 
 export async function deleteUser(userId: string) {
+  const operator = await getUserFromSession()
+  if (!operator || !(operator.role !== "admin")) {
+    return { success: false, error: 'Unauthorized' }
+  }
   try {
     // First, delete all sessions for this user
     await prisma.session.deleteMany({