Restrict injury logging to player's team GMs only

Security fix: Remove user_id from ConfirmationView so only the player's
team GM(s) can click "Log Injury" button. Anyone can still run /injury roll
to see the result, but only authorized GMs can record it.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
Cal Corum 2025-12-19 00:13:42 -06:00
parent 62541ac750
commit 466c8985cb
2 changed files with 2 additions and 2 deletions

View File

@ -1 +1 @@
2.25.0
2.25.1

View File

@ -205,8 +205,8 @@ class InjuryGroup(app_commands.Group):
injury_callback = batter_confirm_callback
# Create confirmation view with appropriate callback
# Only the player's team GM(s) can log the injury
view = ConfirmationView(
user_id=interaction.user.id,
timeout=180.0, # 3 minutes for confirmation
responders=[player.team.gmid, player.team.gmid2] if player.team else None,
confirm_callback=injury_callback,