修复最佳评论越权问题

在AcceptAnswer方法中添加了安全检查,确保要设置为最佳答案的回答确实属于该问题。
这可以防止攻击者将其他问题的回答设置为当前问题的最佳答案。

安全问题:越权设置最佳评论
修复方法:验证acceptedAnswerInfo.QuestionID == req.QuestionID
This commit is contained in:
liqiang46
2025-12-26 23:00:24 +08:00
committed by LinkinStars
parent c2a62804b0
commit 61d9bf34d3
@@ -455,6 +455,11 @@ func (as *AnswerService) AcceptAnswer(ctx context.Context, req *schema.AcceptAns
if !exist {
return errors.BadRequest(reason.AnswerNotFound)
}
// check answer belong to question
if acceptedAnswerInfo.QuestionID != req.QuestionID {
return errors.BadRequest(reason.AnswerNotFound)
}
acceptedAnswerInfo.ID = uid.DeShortID(acceptedAnswerInfo.ID)
}