diff options
author | George Goldberg <george@gberg.me> | 2018-09-14 16:21:05 +0100 |
---|---|---|
committer | Christopher Speller <crspeller@gmail.com> | 2018-09-14 08:21:05 -0700 |
commit | fdbb6de3d52a5f41f075812e3b87616685a21b9b (patch) | |
tree | 1e434c28bf56b82148124f15958f36423e02828c /api4/team.go | |
parent | 83a00ae9251475b3ef39284ba922cb3ca55a6fbe (diff) | |
download | chat-fdbb6de3d52a5f41f075812e3b87616685a21b9b.tar.gz chat-fdbb6de3d52a5f41f075812e3b87616685a21b9b.tar.bz2 chat-fdbb6de3d52a5f41f075812e3b87616685a21b9b.zip |
MM-11520: Make entity ID checks consistent across api4. (#9395)
* MM-11520: Make entity ID checks consistent across api4.
* Update tests.
Diffstat (limited to 'api4/team.go')
-rw-r--r-- | api4/team.go | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/api4/team.go b/api4/team.go index 2c229dce1..5a387ee35 100644 --- a/api4/team.go +++ b/api4/team.go @@ -137,7 +137,11 @@ func updateTeam(c *Context, w http.ResponseWriter, r *http.Request) { return } - team.Id = c.Params.TeamId + // The team being updated in the payload must be the same one as indicated in the URL. + if team.Id != c.Params.TeamId { + c.SetInvalidParam("team_id") + return + } if !c.App.SessionHasPermissionToTeam(c.Session, c.Params.TeamId, model.PERMISSION_MANAGE_TEAM) { c.SetPermissionError(model.PERMISSION_MANAGE_TEAM) |