fixing a critical rights vulnerability

handlers/admin/management/database.py

@@ -11,6 +11,7 @@ from aiogram.fsm.state import State, StatesGroup
 from aiogram.types import CallbackQuery, Message
 
 from config import DB_NAME, DB_PASSWORD, DB_USER, PG_HOST, PG_PORT
+from filters.admin import IsAdminFilter
 from logger import logger
 
 from . import router
@@ -21,7 +22,7 @@ class DatabaseState(StatesGroup):
     waiting_for_backup_file = State()
 
 
-@router.callback_query(AdminPanelCallback.filter(F.action == "database"))
+@router.callback_query(AdminPanelCallback.filter(F.action == "database"), IsAdminFilter())
 async def handle_database_menu(callback: CallbackQuery):
     await callback.message.edit_text(
         text="🗄 <b>Управление базой данных</b>",
@@ -29,7 +30,7 @@ async def handle_database_menu(callback: CallbackQuery):
     )
 
 
-@router.callback_query(AdminPanelCallback.filter(F.action == "restore_db"))
+@router.callback_query(AdminPanelCallback.filter(F.action == "restore_db"), IsAdminFilter())
 async def prompt_restore_db(callback: CallbackQuery, state: FSMContext):
     await callback.message.edit_text(
         "📂 Отправьте файл резервной копии (.sql), чтобы восстановить базу данных.\n"
@@ -39,7 +40,7 @@ async def prompt_restore_db(callback: CallbackQuery, state: FSMContext):
     await state.set_state(DatabaseState.waiting_for_backup_file)
 
 
-@router.message(DatabaseState.waiting_for_backup_file)
+@router.message(DatabaseState.waiting_for_backup_file, IsAdminFilter())
 async def restore_database(message: Message, state: FSMContext, bot: Bot):
     document = message.document
 
@@ -154,7 +155,7 @@ async def restore_database(message: Message, state: FSMContext, bot: Bot):
             pass
 
 
-@router.callback_query(AdminPanelCallback.filter(F.action == "export_db"))
+@router.callback_query(AdminPanelCallback.filter(F.action == "export_db"), IsAdminFilter())
 async def handle_export_db(callback: CallbackQuery):
     await callback.message.edit_text(
         "📤 Выберите панель, с которой требуется получить данные:\n\n"
@@ -163,6 +164,6 @@ async def handle_export_db(callback: CallbackQuery):
     )
 
 
-@router.callback_query(AdminPanelCallback.filter(F.action == "back_to_db_menu"))
+@router.callback_query(AdminPanelCallback.filter(F.action == "back_to_db_menu"), IsAdminFilter())
 async def back_to_database_menu(callback: CallbackQuery):
     await callback.message.edit_text("📦 Управление базой данных:", reply_markup=build_database_kb())