fix(subsonic): fix getAvatar user request comparison (#469)

brian-doherty · web-flow · commit 2949b4c86715 · 2024-02-13T22:30:34.000Z
diff --git a/server/ctrlsubsonic/handlers_raw.go b/server/ctrlsubsonic/handlers_raw.go
@@ -242,7 +242,7 @@ func (c *Controller) ServeGetAvatar(w http.ResponseWriter, r *http.Request) *spe
 		return spec.NewError(10, "please provide an `username` parameter")
 	}
 	reqUser := c.dbc.GetUserByName(username)
-	if (user != reqUser) && !user.IsAdmin {
+	if (user.ID != reqUser.ID) && !user.IsAdmin {
 		return spec.NewError(50, "user not admin")
 	}
 	http.ServeContent(w, r, "", time.Now(), bytes.NewReader(reqUser.Avatar))

Original file line number	Diff line number	Diff line change
`@@ -242,7 +242,7 @@ func (c Controller) ServeGetAvatar(w http.ResponseWriter, r http.Request) *spe`
`242`	`242`	return spec.NewError(10, "please provide an `username` parameter")
`243`	`243`	`}`
`244`	`244`	`reqUser := c.dbc.GetUserByName(username)`
`245`		`- if (user != reqUser) && !user.IsAdmin {`
	`245`	`+ if (user.ID != reqUser.ID) && !user.IsAdmin {`
`246`	`246`	`return spec.NewError(50, "user not admin")`
`247`	`247`	`}`
`248`	`248`	`http.ServeContent(w, r, "", time.Now(), bytes.NewReader(reqUser.Avatar))`