fix: only allow UserActorType for ShareService

2026-05-04 08:30:39 +00:00 · 2024-11-15 12:08:40 -05:00
parent 045259cefb
commit 69bfa60199
1 changed files with 3 additions and 0 deletions
@@ -261,6 +261,9 @@ class ShareService extends BaseService {
            ],
            handler: async (req, res) => {
                const actor = Actor.adapt(req.user);
+                if ( ! (actor.type instanceof UserActorType) ) {
+                    throw APIError.create('forbidden');
+                }
                return await share_sequence.call(this, {
                    actor, req, res,
                });