gowls/teamspeak-music-bot
1
0 Fork 0
mirror of https://github.com/ZHANGTIANYAO1/teamspeak-music-bot.git synced 2026-10-03 05:22:49 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(guest): deny operator personal-data reads to guests

Browse Source 
GET /recommend/songs, /personal/fm, and /user/playlists read the
operator's own logged-in music account; gate them with requireNotGuest
so login-less guests cannot see the operator's recommendations, FM, or
playlists. Generic search/browse stays open.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
saopig1andClaude Opus 4.8 committed 2026-06-25 15:54:29 +08:00
1 parent 365352cdd3
commit 952f1fbad3
2 files changed
+26 -3
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/web/api/music.ts
+3 -3
View File
@@ -128,7 +128,7 @@ export function createMusicRouter(
}
});
router.get("/recommend/songs", async (req, res) => {
router.get("/recommend/songs", requireNotGuest, async (req, res) => {
try {
const provider = getProvider(req.query.platform as string);
if (!provider.getDailyRecommendSongs) {
@@ -143,7 +143,7 @@ export function createMusicRouter(
}
});
router.get("/personal/fm", async (req, res) => {
router.get("/personal/fm", requireNotGuest, async (req, res) => {
try {
const provider = getProvider(req.query.platform as string);
if (!provider.getPersonalFm) {
@@ -158,7 +158,7 @@ export function createMusicRouter(
}
});
router.get("/user/playlists", async (req, res) => {
router.get("/user/playlists", requireNotGuest, async (req, res) => {
try {
const provider = getProvider(req.query.platform as string);
if (!provider.getUserPlaylists) {