prohibit reading others' private messages

2023-05-02 13:38:00 -05:00 · 2023-05-02 13:38:00 -05:00 · 7cd05c6af6
commit 7cd05c6af6
parent 6f7317d58f
1 changed files with 7 additions and 1 deletions
--- a/rsbbs/plugins/read/plugin.py
+++ b/rsbbs/plugins/read/plugin.py
@ -43,7 +43,13 @@ class Plugin():
        with self.api.controller.session() as session:
            try:
                statement = sqlalchemy.select(Message).where(
-                    Message.id == number)
+                    sqlalchemy.or_(
+                        sqlalchemy.and_(
+                            Message.id == number,
+                            Message.recipient == self.api.user.callsign),
+                        sqlalchemy.and_(
+                            Message.id == number,
+                            sqlalchemy.not_(Message.is_private))))
                result = session.execute(statement).one()
                self.api.print_message(result)
                logging.info(f"read message")