fix: check 'with_members' in /systems/:ref/groups against member list privacy

2021-11-19 10:18:12 -05:00
parent 0ca356eec3
commit 85c095a115
1 changed files with 3 additions and 0 deletions
--- a/PluralKit.API/Controllers/v2/GroupControllerV2.cs
+++ b/PluralKit.API/Controllers/v2/GroupControllerV2.cs
@@ -39,6 +39,9 @@ namespace PluralKit.API
                .Select(g => g.ToJson(ctx, needsMembersArray: with_members))
                .ToListAsync();

+            if (with_members && !system.MemberListPrivacy.CanAccess(ctx))
+                throw Errors.UnauthorizedMemberList;
+
            if (with_members && j_groups.Count > 0)
            {
                var q = await _repo.GetGroupMemberInfo(await groups.Select(x => x.Id).ToListAsync());