handleTopic in internal/handlers/api.go does NOT check that the user is a member of the channel before allowing them to set a topic. Any authenticated user can set the topic on any channel they haven't joined.
Suggested fix: Add an IsChannelMember check before SetTopic, similar to handleChannelMsg.
## From QA Audit ([#25 comment](https://git.eeqj.de/sneak/chat/issues/25#issuecomment-10914))
**Severity: BLOCKER**
`handleTopic` in `internal/handlers/api.go` does NOT check that the user is a member of the channel before allowing them to set a topic. Any authenticated user can set the topic on any channel they haven't joined.
**Suggested fix:** Add an `IsChannelMember` check before `SetTopic`, similar to `handleChannelMsg`.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
From QA Audit (#25 comment)
Severity: BLOCKER
handleTopicininternal/handlers/api.godoes NOT check that the user is a member of the channel before allowing them to set a topic. Any authenticated user can set the topic on any channel they haven't joined.Suggested fix: Add an
IsChannelMembercheck beforeSetTopic, similar tohandleChannelMsg.