diff --git a/server/api/v1/screenshots/[id]/index.delete.ts b/server/api/v1/screenshots/[id]/index.delete.ts index 360dbf4..c09c332 100644 --- a/server/api/v1/screenshots/[id]/index.delete.ts +++ b/server/api/v1/screenshots/[id]/index.delete.ts @@ -13,5 +13,16 @@ export default defineEventHandler(async (h3) => { statusMessage: "Missing screenshot ID", }); - return await screenshotManager.delete(screenshotId); + const result = await screenshotManager.get(screenshotId); + if (!result) + throw createError({ + statusCode: 400, + statusMessage: "Incorrect screenshot ID", + }); + else if (result.userId !== userId) + throw createError({ + statusCode: 403, + }); + + await screenshotManager.delete(screenshotId); }); diff --git a/server/api/v1/screenshots/[id]/index.get.ts b/server/api/v1/screenshots/[id]/index.get.ts index da84f6a..7864a1b 100644 --- a/server/api/v1/screenshots/[id]/index.get.ts +++ b/server/api/v1/screenshots/[id]/index.get.ts @@ -13,5 +13,15 @@ export default defineEventHandler(async (h3) => { statusMessage: "Missing screenshot ID", }); - return await screenshotManager.get(screenshotId); + const result = await screenshotManager.get(screenshotId); + if (!result) + throw createError({ + statusCode: 400, + statusMessage: "Incorrect screenshot ID", + }); + else if (result.userId !== userId) + throw createError({ + statusCode: 403, + }); + return result; });