diff options
| -rw-r--r-- | routes/payments.ts | 3 | ||||
| -rw-r--r-- | routes/users.ts | 8 |
2 files changed, 11 insertions, 0 deletions
diff --git a/routes/payments.ts b/routes/payments.ts index 4d1c55c5..ec342dc4 100644 --- a/routes/payments.ts +++ b/routes/payments.ts @@ -268,6 +268,9 @@ export default { amount = parseInt(amount); if (amount < 0) fail("Invalid amount"); + const managers = await db.sMembers(`fund:${id}:managers`); + if (managers.length && !managers.includes(user.id)) fail("Unauthorized"); + const result: any = await db.debit(`fund:${id}`, "", amount, 0, 0, 0); if (result.err) fail(result.err); diff --git a/routes/users.ts b/routes/users.ts index ab8cb61a..8fb078e1 100644 --- a/routes/users.ts +++ b/routes/users.ts @@ -769,8 +769,12 @@ export default { async updateAccount(req, res) { const { id } = req.params; + const { id: uid } = req.user; const { name } = req.body; + const pos = await db.lPos(`${uid}:accounts`, id); + if (!pos) fail("account not found"); + const account = await g(`account:${id}`); account.name = name; await s(`account:${id}`, account); @@ -783,6 +787,10 @@ export default { const { id } = req.body; const { id: uid } = req.user; const { type } = await g(`account:${id}`); + + const pos = await db.lPos(`${uid}:accounts`, id); + if (!(type && pos)) fail("account not found"); + try { const node = rpc({ ...config[type], wallet: id }); await node.unloadWallet(id); |