fix: tighten delete folder permissions

2026-08-20 08:01:35 +00:00 · 2024-04-15 15:44:37 +02:00
parent 7c85cd808d
commit 8b4dc227d3
1 changed files with 1 additions and 0 deletions
@@ -477,6 +477,7 @@ async fn delete_folder(
    let mut tx = user_db.begin(&authed).await?;

    not_found_if_none(get_folderopt(&mut tx, &w_id, &name).await?, "Folder", &name)?;
+    require_is_owner(&authed, &name)?;

    sqlx::query!(
        "DELETE FROM folder WHERE name = $1 AND workspace_id = $2",