From 0c1076c9176cca40df4a39ba00b11e129f07dbbc Mon Sep 17 00:00:00 2001
From: MeiMei <30769358+mei23@users.noreply.github.com>
Date: Mon, 27 Jan 2020 05:36:59 +0900
Subject: [PATCH] =?UTF-8?q?userList=E3=83=81=E3=83=A3=E3=83=B3=E3=83=8D?=
 =?UTF-8?q?=E3=83=AB=E3=81=AE=E3=82=AA=E3=83=BC=E3=83=8A=E3=83=BC=E3=83=81?=
 =?UTF-8?q?=E3=82=A7=E3=83=83=E3=82=AF=20Fix=20#5772=20(#5773)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* userListチャンネルのオーナーチェック Fix #5772

* comment
---
 src/server/api/stream/channels/user-list.ts | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/server/api/stream/channels/user-list.ts b/src/server/api/stream/channels/user-list.ts
index 119bacf6ec..e1b7a88830 100644
--- a/src/server/api/stream/channels/user-list.ts
+++ b/src/server/api/stream/channels/user-list.ts
@@ -1,6 +1,6 @@
 import autobind from 'autobind-decorator';
 import Channel from '../channel';
-import { Notes, UserListJoinings } from '../../../../models';
+import { Notes, UserListJoinings, UserLists } from '../../../../models';
 import shouldMuteThisNote from '../../../../misc/should-mute-this-note';
 import { User } from '../../../../models/entities/user';
 import { PackedNote } from '../../../../models/repositories/note';
@@ -17,6 +17,13 @@ export default class extends Channel {
 	public async init(params: any) {
 		this.listId = params.listId as string;
 
+		// Check existence and owner
+		const list = await UserLists.findOne({
+			id: this.listId,
+			userId: this.user!.id
+		});
+		if (!list) return;
+
 		// Subscribe stream
 		this.subscriber.on(`userListStream:${this.listId}`, this.send);