Add permission check for managing entities in DeleteEntity request handler

This commit is contained in:
netkas 2025-06-05 15:16:12 -04:00
parent 19b932904a
commit fc6014b37e
Signed by: netkas
GPG key ID: 4D8629441B76E4CC

View file

@ -16,6 +16,12 @@
*/
public static function handleRequest(): void
{
$authenticatedOperator = FederationServer::getAuthenticatedOperator();
if(!$authenticatedOperator->canManageBlacklist())
{
throw new RequestException('Unauthorized: Insufficient permissions to manage entities', 401);
}
if(!preg_match('#^/entities/([a-fA-F0-9\-]{36,})$#', FederationServer::getPath(), $matches))
{
throw new RequestException('Bad Request: Entity UUID is required', 400);