From fdbb6de3d52a5f41f075812e3b87616685a21b9b Mon Sep 17 00:00:00 2001
From: George Goldberg <george@gberg.me>
Date: Fri, 14 Sep 2018 16:21:05 +0100
Subject: MM-11520: Make entity ID checks consistent across api4. (#9395)

* MM-11520: Make entity ID checks consistent across api4.

* Update tests.
---
 api4/post.go | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'api4/post.go')

diff --git a/api4/post.go b/api4/post.go
index 014174b37..46c688014 100644
--- a/api4/post.go
+++ b/api4/post.go
@@ -382,6 +382,12 @@ func updatePost(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// The post being updated in the payload must be the same one as indicated in the URL.
+	if post.Id != c.Params.PostId {
+		c.SetInvalidParam("post_id")
+		return
+	}
+
 	if !c.App.SessionHasPermissionToChannelByPost(c.Session, c.Params.PostId, model.PERMISSION_EDIT_POST) {
 		c.SetPermissionError(model.PERMISSION_EDIT_POST)
 		return
-- 
cgit v1.2.3-1-g7c22