papercups
papercups copied to clipboard
Unauthorized users can delete integrations
Describe the bug Any authenticated user can delete any user's Slack, Gmail, Mattermost, and Twilio integration if they have the right ID.
def delete(conn, %{"id" => id}) do
with %{account_id: _account_id} <- conn.assigns.current_user, # note the unused account_id
%TwilioAuthorization{} = auth <-
Twilio.get_twilio_authorization!(id),
{:ok, %TwilioAuthorization{}} <- Twilio.delete_twilio_authorization(auth) do
send_resp(conn, :no_content, "")
end
end
Return of the Bodyguard...?