From aad9bbbaf5d4a3d1d8d4cf9593233e8acf82605c Mon Sep 17 00:00:00 2001 From: AiAe Date: Tue, 1 Sep 2026 13:34:17 +0300 Subject: [PATCH 1/2] Allow auth user to update their discord id --- handlers/users.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/handlers/users.go b/handlers/users.go index 138a507..0cc4034 100644 --- a/handlers/users.go +++ b/handlers/users.go @@ -385,8 +385,8 @@ func UpdateUserDiscordId(c *gin.Context) *APIError { return nil } - if !enums.HasPrivilege(user.Privileges, enums.PrivilegeEditUsers) { - return APIErrorForbidden("You do not have permission to access this resource.") + if id != user.Id { + return APIErrorForbidden("You can only update your own Discord ID.") } if err := db.UpdateUserDiscordId(id, body.DiscordId); err != nil { From bfbdf1597e168ebda5779b05525097550207d35a Mon Sep 17 00:00:00 2001 From: AiAe Date: Tue, 1 Sep 2026 13:45:23 +0300 Subject: [PATCH 2/2] Remove forbidden check --- handlers/users.go | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) diff --git a/handlers/users.go b/handlers/users.go index 0cc4034..01cd63e 100644 --- a/handlers/users.go +++ b/handlers/users.go @@ -365,12 +365,6 @@ func BanUser(c *gin.Context) *APIError { // UpdateUserDiscordId Updates a user's discord id // Endpoint: POST /v2/user/:id/discord func UpdateUserDiscordId(c *gin.Context) *APIError { - id, err := strconv.Atoi(c.Param("id")) - - if err != nil { - return APIErrorBadRequest("You must supply a valid username or id.") - } - body := struct { DiscordId *string `form:"discord_id" json:"discord_id" binding:"required"` }{} @@ -385,11 +379,7 @@ func UpdateUserDiscordId(c *gin.Context) *APIError { return nil } - if id != user.Id { - return APIErrorForbidden("You can only update your own Discord ID.") - } - - if err := db.UpdateUserDiscordId(id, body.DiscordId); err != nil { + if err := db.UpdateUserDiscordId(user.Id, body.DiscordId); err != nil { return APIErrorServerError("Error updating user discord id", err) }