Check a tool's connection before writing its permissions

This commit is contained in:
arc53-machine committed 2026-09-29 00:40:33 +01:00
1 parent 33f29cb408
commit a260ca44f1
3 files changed
+34 -5

No files matched your search

+2 -2
View File
@@ -426,8 +426,8 @@ class ConnectionToolPermissions(Resource):
row = _owned(conn, connection_id, user_id)
if row is None:
return _not_found()
tool = service.set_tool_permissions(conn, user_id, tool_id, permissions)
if tool is None or str(tool.get("connection_id")) != connection_id:
tool = service.set_tool_permissions(conn, user_id, connection_id, tool_id, permissions)
if tool is None:
return _not_found()
payload = service.serialize_tool(tool)
return make_response(jsonify({"success": True, "tool": payload}), 200)