randomouscrap98 / contentapi

A generic content system to make some kinda standard websites
GNU General Public License v3.0
9 stars 2 forks source link

Disallow setting user statuses in private rooms #121

Open randomouscrap98 opened 2 years ago

randomouscrap98 commented 2 years ago

In the extensions for getting the userlist, it removes private rooms. The user status tracker has no concept of privacy, but the extensions do. But it doesn't seem to prevent you from WRITING to private rooms, only reading FROM. Probabably should prevent both, and also if there are exceptions (such as global room 0 always being available), the exceptions need to be included in both functions. Probably as simple as having a wrapper in that same extensions class