diff options
| -rw-r--r-- | lib/invoices.ts | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/lib/invoices.ts b/lib/invoices.ts index 7f25f4ba..c4e6a131 100644 --- a/lib/invoices.ts +++ b/lib/invoices.ts @@ -57,7 +57,12 @@ export const generate = async ({ invoice, user }) => { if (!user) fail("user not provided"); if (typeof prompt === "undefined") prompt = user.prompt; - let account = await g(`account:${aid}`); + // The invoice shows `user`'s name but credits `aid`, so a supplied aid must + // be one of that user's own accounts — otherwise anyone could put a + // merchant's name on an invoice that pays their own account. + if (aid && aid !== user.id && (await db.lPos(`${user.id}:accounts`, aid)) === null) + aid = undefined; + let account = aid ? await g(`account:${aid}`) : null; if (!account) account = await g(`account:${user.id}`); if (!account) fail("account not found"); aid = account.id; |