fix: authorization in get_attachment

ElaBosak233 · Nov 11, 2024 · da7ba7a · da7ba7a
1 parent 443ac93
commit da7ba7a
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/src/web/router/challenge/mod.rs b/src/web/router/challenge/mod.rs
@@ -307,7 +307,8 @@ pub async fn delete(
     })
 }
 
-pub async fn get_attachment(Path(id): Path<i64>) -> Result<impl IntoResponse, WebError> {
+pub async fn get_attachment(Extension(ext): Extension<Ext>, Path(id): Path<i64>) -> Result<impl IntoResponse, WebError> {
+    let _ = ext.operator.ok_or(WebError::Unauthorized(String::new()))?;
     let path = format!("challenges/{}/attachment", id);
     match crate::media::scan_dir(path.clone()).await.unwrap().first() {
         Some((filename, _size)) => {