Merge pull request #947 from pjmartorell/fix/voting-arbitrary-boxer

Fix bug when passing an unrelated boxer id as a voteId to `POST /api/votes/<combatId>` endpoint
midudev · May 6, 2024 · 358f0de · 358f0de
2 parents aa04525 + 7f95eaf
commit 358f0de
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/src/pages/api/votes/[combatId].ts b/src/pages/api/votes/[combatId].ts
@@ -34,6 +34,8 @@ export const POST: APIRoute = async ({ params, request }) => {
 	if (!success) return res("Bad request", { status: 400 })
 
 	const { voteId } = output
+	const boxerData = combatData.boxers.find((b) => b === voteId)
+	if (!boxerData) return res("Boxer not found", { status: 404 })
 
 	const userId = session.user.id
 	const votedAt = NOW