From fdbb6de3d52a5f41f075812e3b87616685a21b9b Mon Sep 17 00:00:00 2001
From: George Goldberg <george@gberg.me>
Date: Fri, 14 Sep 2018 16:21:05 +0100
Subject: MM-11520: Make entity ID checks consistent across api4. (#9395)

* MM-11520: Make entity ID checks consistent across api4.

* Update tests.
---
 api4/oauth.go | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'api4/oauth.go')

diff --git a/api4/oauth.go b/api4/oauth.go
index 990f292e9..2ed6641ee 100644
--- a/api4/oauth.go
+++ b/api4/oauth.go
@@ -91,6 +91,12 @@ func updateOAuthApp(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// The app being updated in the payload must be the same one as indicated in the URL.
+	if oauthApp.Id != c.Params.AppId {
+		c.SetInvalidParam("app_id")
+		return
+	}
+
 	c.LogAudit("attempt")
 
 	oldOauthApp, err := c.App.GetOAuthApp(c.Params.AppId)
-- 
cgit v1.2.3-1-g7c22