fixup: actually check whether the group joining is from the user

This commit is contained in:
Johann150 2023-01-13 21:55:14 +01:00
parent 83373e0c51
commit 3d2cfc075a
Signed by untrusted user: Johann150
GPG key ID: 9EE6577A2A06F8F1

View file

@ -147,6 +147,8 @@ export const UserRepository = db.getRepository(User).extend({
JOIN "user_group_joining"
ON "messaging_message"."groupId" = "user_group_joining"."userGroupId"
WHERE
"user_group_joining"."userId" = $1
AND
"messaging_message"."userId" != $1
AND
NOT $1 = ANY("messaging_message"."reads")