search

freyacodes / archived-bot

A Discord music bot serving music in over 3 million discord servers
https://fredboat.com/docs
MIT License
487 stars 210 forks source link

SayCommand is not secure #633

Open ghost opened 4 years ago

ghost commented 4 years ago

image 1) I (and he) cannot tag @Community role, 2) We have the same role

The problem is : Even if the person does not have permission to mention the role, by issuing the command ;;say, if the bot has this permission, it mentions all the people having the role.

If the issue does not seem sufficiently explained to you, tell me.

SpaghettDev commented 4 years ago

Maybe making it so you cant mention roles/users when using the say command? Or maybe even better, making it so only users with some higher-up permission (ex: MANAGE_MESSAGES) to be able to execute that command.