From 056d6f50ec5868d4a553431560fd65f4fa7f3e7d Mon Sep 17 00:00:00 2001 From: Capybara-z Date: Thu, 5 Feb 2026 16:58:55 +0300 Subject: [PATCH] fixing a critical rights vulnerability --- handlers/admin/management/domain.py | 2 +- handlers/admin/settings/settings_notifications.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/handlers/admin/management/domain.py b/handlers/admin/management/domain.py index b21513fa..70507ac2 100644 --- a/handlers/admin/management/domain.py +++ b/handlers/admin/management/domain.py @@ -28,7 +28,7 @@ async def request_new_domain(callback_query: CallbackQuery, state: FSMContext): ) -@router.message(AdminManagementStates.waiting_for_new_domain) +@router.message(AdminManagementStates.waiting_for_new_domain, IsAdminFilter()) async def process_new_domain(message: Message, state: FSMContext, session: AsyncSession): new_domain = message.text.strip() diff --git a/handlers/admin/settings/settings_notifications.py b/handlers/admin/settings/settings_notifications.py index 32c79938..7a4bad3c 100644 --- a/handlers/admin/settings/settings_notifications.py +++ b/handlers/admin/settings/settings_notifications.py @@ -105,7 +105,7 @@ async def edit_notification_interval_setting( await callback.answer() -@router.message(NotificationIntervalEditState.waiting_for_value) +@router.message(NotificationIntervalEditState.waiting_for_value, IsAdminFilter()) async def notification_interval_value_input(message: Message, state: FSMContext, session: AsyncSession) -> None: text_value = (message.text or "").strip()