(answer) branch dev updated: 修复最佳评论越权问题

[linkinstar]

This is an automated email from the ASF dual-hosted git repository.

linkinstar pushed a commit to branch dev
in repository https://gitbox.apache.org/repos/asf/answer.git


The following commit(s) were added to refs/heads/dev by this push:
     new 61d9bf34 修复最佳评论越权问题
61d9bf34 is described below

commit 61d9bf34d3f9c60ee6db426ba4e6a90e76a1500a
Author: liqiang46 <a625846...@163.com>
AuthorDate: Fri Dec 26 23:00:24 2025 +0800

    修复最佳评论越权问题
    
    在AcceptAnswer方法中添加了安全检查，确保要设置为最佳答案的回答确实属于该问题。
    这可以防止攻击者将其他问题的回答设置为当前问题的最佳答案。
    
    安全问题：越权设置最佳评论
    修复方法：验证acceptedAnswerInfo.QuestionID == req.QuestionID
---
 internal/service/content/answer_service.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/internal/service/content/answer_service.go 
b/internal/service/content/answer_service.go
index f904b82f..d3aab20b 100644
--- a/internal/service/content/answer_service.go
+++ b/internal/service/content/answer_service.go
@@ -455,6 +455,11 @@ func (as *AnswerService) AcceptAnswer(ctx context.Context, 
req *schema.AcceptAns
                if !exist {
                        return errors.BadRequest(reason.AnswerNotFound)
                }
+
+               // check answer belong to question
+               if acceptedAnswerInfo.QuestionID != req.QuestionID {
+                       return errors.BadRequest(reason.AnswerNotFound)
+               }
                acceptedAnswerInfo.ID = uid.DeShortID(acceptedAnswerInfo.ID)
        }