From 82846ab63307b4c125d2867442dc2cf5b2f509af Mon Sep 17 00:00:00 2001
From: michaelschal <35957947-michaelschal@users.noreply.replit.com>
Date: Tue, 14 Oct 2025 14:11:16 +0000
Subject: [PATCH] Ensure users can only post to pages they have access to

Add access control to the posting route in server/routes.ts to verify user permissions against specified pageIds, preventing unauthorized posts.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: ae4037a0-2a6f-4530-9bac-79b543286bda
Replit-Commit-Checkpoint-Type: intermediate_checkpoint
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/397bca8c-984f-43ff-841a-10897aeb8140/ae4037a0-2a6f-4530-9bac-79b543286bda/tWDOGLP
---
 server/routes.ts | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/server/routes.ts b/server/routes.ts
index 76244fc..f772145 100644
--- a/server/routes.ts
+++ b/server/routes.ts
@@ -793,6 +793,22 @@ export async function registerRoutes(app: Express): Promise<Server> {
         return res.status(400).json({ error: "Les stories nécessitent au moins un média (image ou vidéo)" });
       }
       
+      // Security: Verify user has access to all specified pages (unless admin)
+      if (user.role !== 'admin' && pageIds && Array.isArray(pageIds) && pageIds.length > 0) {
+        const accessiblePages = await storage.getUserAccessiblePages(userId);
+        const accessiblePageIds = accessiblePages.map(p => p.id);
+        
+        const hasAccessToAllPages = pageIds.every(pageId => 
+          accessiblePageIds.includes(pageId)
+        );
+        
+        if (!hasAccessToAllPages) {
+          return res.status(403).json({ 
+            error: "Vous n'avez pas accès à certaines pages sélectionnées" 
+          });
+        }
+      }
+      
       // Convert scheduledFor string to Date if provided
       if (postFields.scheduledFor && typeof postFields.scheduledFor === 'string') {
         postFields.scheduledFor = new Date(postFields.scheduledFor);