Restrict injury logging to player's team GMs only
Security fix: Remove user_id from ConfirmationView so only the player's team GM(s) can click "Log Injury" button. Anyone can still run /injury roll to see the result, but only authorized GMs can record it. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
parent
62541ac750
commit
466c8985cb
@ -205,8 +205,8 @@ class InjuryGroup(app_commands.Group):
|
||||
injury_callback = batter_confirm_callback
|
||||
|
||||
# Create confirmation view with appropriate callback
|
||||
# Only the player's team GM(s) can log the injury
|
||||
view = ConfirmationView(
|
||||
user_id=interaction.user.id,
|
||||
timeout=180.0, # 3 minutes for confirmation
|
||||
responders=[player.team.gmid, player.team.gmid2] if player.team else None,
|
||||
confirm_callback=injury_callback,
|
||||
|
||||
Loading…
Reference in New Issue
Block a user