Repository navigation
fix(bot): enforce role lists in DMs, other servers and autocomplete - #141
Merged
Merged
Conversation
checkRolePermission() returned true whenever there was no guild member, which is the case for interactions in a DM with the bot. Since slash commands are registered globally and available in DMs, a user missing from ROLE_ALLOWLIST or listed in ROLE_BLOCKLIST could still use /request and /search by messaging the bot directly. The check also ignored which guild an interaction came from, so a blocklisted user could use the bot in any other server it is in, where the blocked role doesn't exist. When a role list is set, interactions are now only allowed from members of the configured GUILD_ID (denied and logged if GUILD_ID is empty). Autocomplete is gated as well (empty suggestions instead of TMDB/Seerr lookups), and two select menu prefixes that no handler uses are no longer exempt from the check. Without role lists, nothing changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
ROLE_ALLOWLISTandROLE_BLOCKLISTcould be bypassed:/requestand/searchby messaging the bot directly.Fix
GUILD_ID. DMs and other servers are denied. If role lists are set butGUILD_IDis empty, interactions are denied and a warning is logged.