Skip to content

Commit 61d9bf3

Browse files
QiangLi826LinkinStars
authored andcommitted
修复最佳评论越权问题
在AcceptAnswer方法中添加了安全检查,确保要设置为最佳答案的回答确实属于该问题。 这可以防止攻击者将其他问题的回答设置为当前问题的最佳答案。 安全问题:越权设置最佳评论 修复方法:验证acceptedAnswerInfo.QuestionID == req.QuestionID
1 parent c2a6280 commit 61d9bf3

1 file changed

Lines changed: 5 additions & 0 deletions

File tree

internal/service/content/answer_service.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -455,6 +455,11 @@ func (as *AnswerService) AcceptAnswer(ctx context.Context, req *schema.AcceptAns
455455
if !exist {
456456
return errors.BadRequest(reason.AnswerNotFound)
457457
}
458+
459+
// check answer belong to question
460+
if acceptedAnswerInfo.QuestionID != req.QuestionID {
461+
return errors.BadRequest(reason.AnswerNotFound)
462+
}
458463
acceptedAnswerInfo.ID = uid.DeShortID(acceptedAnswerInfo.ID)
459464
}
460465

0 commit comments

Comments
 (0)