fix: 限制用户访问任意私聊

2025-10-19 11:55:57 +08:00
parent 306bfa2b82
commit 5a34054024
1 changed files with 4 additions and 0 deletions
--- a/server/api/ChatApi.ts
+++ b/server/api/ChatApi.ts
@@ -43,6 +43,10 @@ export default class ChatApi extends BaseApi {

            // 私聊
            if (chat!.bean.type == 'private') {
+                if (!UserChatLinker.checkUserIsLinkedToChat(token.author, chat!.bean.id)) return {
+                    code: 403,
+                    msg: "用户无权访问此对话",
+                }
                const mine = User.findById(token.author) as User

                return {