fix(emailaliascontroller): check that user owns alias

Shroud-email · Jul 8, 2024 · b9cafbc · b9cafbc
1 parent 6bc0e96
commit b9cafbc
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/lib/shroud_web/controllers/api/v1/email_alias_controller.ex b/lib/shroud_web/controllers/api/v1/email_alias_controller.ex
@@ -66,6 +66,7 @@ defmodule ShroudWeb.Api.V1.EmailAliasController do
     alias =
       EmailAlias
       |> where([ea], is_nil(ea.deleted_at))
+      |> where([ea], ea.user_id == ^conn.assigns.current_user.id)
       |> Repo.get_by(address: address)
 
     if is_nil(alias) do