search

sylveon / discord-ban-appeals

Sample ban appeals page with OAuth2 integration
https://discord-ban-appeal-preview.netlify.app/
MIT License
140 stars 48 forks source link

Feature Suggestions #42

Closed Galaxy-Coding closed 2 years ago

Galaxy-Coding commented 2 years ago

I have 3 suggestions:

sylveon commented 2 years ago

Use a captcha service to prevent spam

This is tracked by #12

Make the message send a message in a channel that includes a button interaction. When the button is pressed, the user is unbanned

This is a thing since https://github.com/sylveon/discord-ban-appeals/pull/37 has been merged

When a user is unbanned by a moderator (by pressing the button), the bot uses the guilds.join scope to add the user to the server.

Since this bot cannot use a database, we would have to store the banned user's token in the unban link, giving all mods access to the user's account with that scope by reading the link. This would be a security vulnerability.

Galaxy-Coding commented 2 years ago

@sylveon It’s been a while, sorry. I don’t think you have to store the user’s token in the unban link, just their ID. I’m not 100% sure about this. See the discord.js documentation for GuildMemberManager#add()

sylveon commented 2 years ago

If you check the raw API, you'll notice an access token is needed: https://discord.com/developers/docs/resources/guild#add-guild-member