@ -92,7 +92,7 @@ app.cacheBuster = null;
switch(url_parts[0]) {
case 'user':
room = 'user/' + ajaxify.data ? ajaxify.data.theirid : 0;
room = 'user/' + (ajaxify.data ? ajaxify.data.theirid : 0);
break;
case 'topic':
room = 'topic_' + url_parts[1];
@ -59,6 +59,10 @@ SocketMeta.rooms.enter = function(socket, data, callback) {
return callback(new Error('[[error:invalid-data]]'));
}
if (data.enter) {
data.enter = data.enter.toString();
if (data.enter && data.enter.startsWith('uid_') && data.enter !== 'uid_' + socket.uid) {
return callback(new Error('[[error:not-allowed]]'));