LLM OCP API: Fix security issue

Signed-off-by: Marcel Klehr <mklehr@gmx.net>
nextcloud · Jul 7, 2023 · f7e1e79 · f7e1e79
1 parent 62b19e0
commit f7e1e79
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/core/Controller/LanguageModelApiController.php b/core/Controller/LanguageModelApiController.php
@@ -85,6 +85,10 @@ public function getTask(int $id): DataResponse {
 		try {
 			$task = $this->languageModelManager->getTask($id);
 
+			if ($this->userId !== $task->getUserId()) {
+				return new DataResponse(['message' => $this->l->t('Task not found')], Http::STATUS_NOT_FOUND);
+			}
+
 			return new DataResponse([
 				'task' => $task,
 			]);