Files
chat/internal
user 53e0abb134
All checks were successful
check / check (push) Successful in 1m14s
security: enforce channel membership check in handleTopic
handleTopic did not verify that the requesting user was a member of the
channel before allowing them to set a topic. Any authenticated user could
set the topic on any channel they hadn't joined.

Add an IsChannelMember check after resolving the channel and before
calling executeTopic, mirroring the existing pattern in handleChannelMsg.
Non-members now receive ERR_NOTONCHANNEL (442).

Add TestTopicNonMember to verify the fix.
2026-03-17 02:14:32 -07:00
..