diff options
Diffstat (limited to 'api4/post.go')
| -rw-r--r-- | api4/post.go | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/api4/post.go b/api4/post.go index 014174b37..46c688014 100644 --- a/api4/post.go +++ b/api4/post.go @@ -382,6 +382,12 @@ func updatePost(c *Context, w http.ResponseWriter, r *http.Request) { return } + // The post being updated in the payload must be the same one as indicated in the URL. + if post.Id != c.Params.PostId { + c.SetInvalidParam("post_id") + return + } + if !c.App.SessionHasPermissionToChannelByPost(c.Session, c.Params.PostId, model.PERMISSION_EDIT_POST) { c.SetPermissionError(model.PERMISSION_EDIT_POST) return |