From 61d9bf34d3f9c60ee6db426ba4e6a90e76a1500a Mon Sep 17 00:00:00 2001
From: liqiang46 <a625846910@163.com>
Date: Fri, 26 Dec 2025 23:00:24 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E6=9C=80=E4=BD=B3=E8=AF=84?=
 =?UTF-8?q?=E8=AE=BA=E8=B6=8A=E6=9D=83=E9=97=AE=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

在AcceptAnswer方法中添加了安全检查，确保要设置为最佳答案的回答确实属于该问题。
这可以防止攻击者将其他问题的回答设置为当前问题的最佳答案。

安全问题：越权设置最佳评论
修复方法：验证acceptedAnswerInfo.QuestionID == req.QuestionID
---
 internal/service/content/answer_service.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/internal/service/content/answer_service.go b/internal/service/content/answer_service.go
index f904b82f..d3aab20b 100644
--- a/internal/service/content/answer_service.go
+++ b/internal/service/content/answer_service.go
@@ -455,6 +455,11 @@ func (as *AnswerService) AcceptAnswer(ctx context.Context, req *schema.AcceptAns
 		if !exist {
 			return errors.BadRequest(reason.AnswerNotFound)
 		}
+
+		// check answer belong to question
+		if acceptedAnswerInfo.QuestionID != req.QuestionID {
+			return errors.BadRequest(reason.AnswerNotFound)
+		}
 		acceptedAnswerInfo.ID = uid.DeShortID(acceptedAnswerInfo.ID)
 	}