From a81b1abec72d0fb35fd88d6171ab3ece2c4c43b2 Mon Sep 17 00:00:00 2001 From: Hampus Date: Wed, 19 Aug 2026 12:41:07 +0200 Subject: [PATCH] fix(api): reject alt text edits on forwarded messages (#1739) --- .../channel/services/message/MessageEditService.ts | 14 +------------- .../ui/action_menu/items/MediaMenuData.tsx | 3 ++- 2 files changed, 3 insertions(+), 14 deletions(-) diff --git a/fluxer_api/src/api/channel/services/message/MessageEditService.ts b/fluxer_api/src/api/channel/services/message/MessageEditService.ts index 0ff6ea2ae..e933aa5a8 100644 --- a/fluxer_api/src/api/channel/services/message/MessageEditService.ts +++ b/fluxer_api/src/api/channel/services/message/MessageEditService.ts @@ -93,19 +93,7 @@ export class MessageEditService { assertGuildMemberCanCommunicate(member); } if (data.message_snapshots !== undefined) { - const isAuthor = message.authorId === userId; - const canManage = isAuthor ? true : await hasPermission(Permissions.MANAGE_MESSAGES); - if (!isAuthor && !canManage) { - throw new MissingPermissionsError(); - } - const updatedMessage = await this.withMessageLock(channelId, messageId, () => - this.deps.persistenceService.updateSnapshotAttachments({ - message, - snapshotEdits: data.message_snapshots ?? [], - }), - ); - await this.deps.dispatchService.dispatchMessageUpdate({channel, message: updatedMessage, requestCache}); - return updatedMessage; + throw new MissingPermissionsError(); } const user = await this.deps.userRepository.findUnique(userId); this.deps.validationService.validateMessageEditable(message); diff --git a/fluxer_app/src/features/ui/action_menu/items/MediaMenuData.tsx b/fluxer_app/src/features/ui/action_menu/items/MediaMenuData.tsx index 6fe911d39..6893b53e4 100644 --- a/fluxer_app/src/features/ui/action_menu/items/MediaMenuData.tsx +++ b/fluxer_app/src/features/ui/action_menu/items/MediaMenuData.tsx @@ -570,6 +570,7 @@ export function useMediaMenuData(props: MediaMenuDataProps, options: MediaMenuDa const canManageMessages = Permission.can(Permissions.MANAGE_MESSAGES, {channelId: message.channelId}); const canEditAltText = useMemo(() => { if (!attachmentId) return false; + if (snapshotIndex !== undefined || message.messageSnapshots) return false; const attachmentSource = snapshotAttachments ?? message.attachments; const attachment = attachmentSource.find((att) => att.id === attachmentId); const mimeType = attachment?.content_type?.toLowerCase() ?? ''; @@ -577,7 +578,7 @@ export function useMediaMenuData(props: MediaMenuDataProps, options: MediaMenuDa if (!canEditMedia) return false; const isMessageAuthor = currentUserId === message.author?.id; return isMessageAuthor || canManageMessages; - }, [attachmentId, canManageMessages, currentUserId, message, snapshotAttachments]); + }, [attachmentId, canManageMessages, currentUserId, message, snapshotAttachments, snapshotIndex]); const handleAddToFavorites = useCallback(() => { ModalCommands.pushAfterBottomSheetClose( onClose,