account check

2 files changed, 11 insertions, 0 deletions

diff --git a/routes/payments.ts b/routes/payments.ts
index 4d1c55c5..ec342dc4 100644
--- a/routes/payments.ts
+++ b/routes/payments.ts
@@ -268,6 +268,9 @@ export default {
       amount = parseInt(amount);
       if (amount < 0) fail("Invalid amount");
 
+      const managers = await db.sMembers(`fund:${id}:managers`);
+      if (managers.length && !managers.includes(user.id)) fail("Unauthorized");
+
       const result: any = await db.debit(`fund:${id}`, "", amount, 0, 0, 0);
       if (result.err) fail(result.err);
 
diff --git a/routes/users.ts b/routes/users.ts
index ab8cb61a..8fb078e1 100644
--- a/routes/users.ts
+++ b/routes/users.ts
@@ -769,8 +769,12 @@ export default {
 
   async updateAccount(req, res) {
     const { id } = req.params;
+    const { id: uid } = req.user;
     const { name } = req.body;
 
+    const pos = await db.lPos(`${uid}:accounts`, id);
+    if (!pos) fail("account not found");
+
     const account = await g(`account:${id}`);
     account.name = name;
     await s(`account:${id}`, account);
@@ -783,6 +787,10 @@ export default {
       const { id } = req.body;
       const { id: uid } = req.user;
       const { type } = await g(`account:${id}`);
+
+      const pos = await db.lPos(`${uid}:accounts`, id);
+      if (!(type && pos)) fail("account not found");
+
       try {
         const node = rpc({ ...config[type], wallet: id });
         await node.unloadWallet(id);