From 496e982ba730a88942286ae4defa031b6e554698 Mon Sep 17 00:00:00 2001 From: shaohuzhang1 Date: Tue, 22 Sep 2026 15:36:04 +0800 Subject: [PATCH] fix: Like/Dislike API endpoints still accept cross-client operations. --- apps/chat/serializers/chat_record.py | 10 ++++++++++ apps/chat/views/chat_record.py | 3 ++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/apps/chat/serializers/chat_record.py b/apps/chat/serializers/chat_record.py index f64d06e6a71..3ba8d7c3984 100644 --- a/apps/chat/serializers/chat_record.py +++ b/apps/chat/serializers/chat_record.py @@ -47,6 +47,16 @@ class VoteSerializer(serializers.Serializer): chat_record_id = serializers.UUIDField(required=True, label=_("Conversation record id")) + chat_user_id = serializers.UUIDField(required=True, label=_("Chat User ID")) + + def is_valid(self, *, raise_exception=False): + super().is_valid(raise_exception=True) + chat_user_id = self.data.get('chat_user_id') + chat_record_id = self.data.get('chat_record_id') + chat_id = self.data.get('chat_id') + if QuerySet(ChatRecord).filter(chat_id=chat_id, chat_record_id=chat_record_id, + chat__chat_user_id=chat_user_id).exists(): + raise AppApiException(500, _('Chat is not exist')) @transaction.atomic def vote(self, instance: Dict, with_valid=True): diff --git a/apps/chat/views/chat_record.py b/apps/chat/views/chat_record.py index 0731f3dfc02..b64066a7605 100644 --- a/apps/chat/views/chat_record.py +++ b/apps/chat/views/chat_record.py @@ -38,7 +38,8 @@ def put(self, request: Request, chat_id: str, chat_record_id: str): return result.success(VoteSerializer( data={'application_id': request.auth.application_id, 'chat_id': chat_id, - 'chat_record_id': chat_record_id + 'chat_record_id': chat_record_id, + 'chat_user_id': request.auth.chat_user_id, }).vote(request.data))