Unauthorized users can move other users' queued tracks

[xayanide]

Describe the bug

Users without DJ roles or Admin permissions are able to move and reorder tracks added by other users in the queue. This is likely a regression bug from removing ownership restrictions for autoplay tracks.

Severity

Low

Affected branches

• Stable
• Staging
• Next

Quaver version

8.0.0-next.130

Steps to reproduce

1. User A (regular user) adds tracks to the queue.
2. User B (non-admin, no DJ role) attempts to move/reorder User A's queued tracks.
3. Observe that User B is able to successfully reorder User A's tracks.

Expected behavior

Non-admin and non-DJ users should only be able to modify or move their own queued tracks, not those belonging to other users.

Actual behavior

Non-admin and non-DJ users can reorder and move tracks queued by other users regardless of DJ role enforcement.

Relevant log output

[zptx-bot]

🎉 This issue has been resolved in version 8.0.0-next.131 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

[xayanide]

I think it still persists or do I have to refresh a new queue because the restored one might be stale from the previous version?

[zapteryx]

I think it still persists or do I have to refresh a new queue because the restored one might be stale from the previous version?

could you try in a different server + vc to instantiate a new session? if it still persists then the bug might not be fixed

[xayanide]

Persists as of 8.0.0-next.135

[zapteryx]

can confirm that move intentionally does not have requester permission checks.
remove, skip, skipto have requester checks as they are destructive ops - however, move is non-destructive. if i restricted move to your own tracks, you'd still be able to move your tracks around other's tracks, which would circumvent the restriction anyway.
the earlier bugfix did however fix a regression in remove, skip and skipto's use of the requester check function. that fix will stay in place. however, the move command specifically is NAB.