Skip to content

Commit 965fa0b

Browse files
committed
Do not allow impersonating yourself
1 parent 332fdb5 commit 965fa0b

File tree

1 file changed

+8
-5
lines changed

1 file changed

+8
-5
lines changed

src/zulip.rs

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -187,16 +187,19 @@ async fn handle_command<'a>(
187187
let mut impersonated = false;
188188
if let Some(&"as") = words.get(0) {
189189
if let Some(username) = words.get(1) {
190-
impersonated = true;
191-
192-
// Impersonate => change actual gh_id
193-
gh_id = match get_id_for_username(&ctx.github, username)
190+
let impersonated_gh_id = match get_id_for_username(&ctx.github, username)
194191
.await
195192
.context("getting ID of github user")?
196193
{
197-
Some(id) => id.try_into().unwrap(),
194+
Some(id) => id.try_into()?,
198195
None => anyhow::bail!("Can only authorize for other GitHub users."),
199196
};
197+
198+
// Impersonate => change actual gh_id
199+
if impersonated_gh_id != gh_id {
200+
impersonated = true;
201+
gh_id = impersonated_gh_id;
202+
}
200203
} else {
201204
return Err(anyhow::anyhow!(
202205
"Failed to parse command; expected `as <username> <command...>`."

0 commit comments

Comments
 (0)