Add team ownership check in /injury set-new #18

New Issue

cal · 2026-02-20T06:48:50Z

cal commented

2026-02-20 06:48:50 +00:00

Description

commands/injuries/management.py:418 — The injury_set_new command explicitly skips verifying that the invoking user actually owns the team the player is on. The comment reads: # TODO: Add team ownership verification. Any league player with the Season 13 Players role can currently set an injury on any player on any team without being blocked.

File Locations

commands/injuries/management.py:418

Labels

security, bug, todo

Priority

high

## Description `commands/injuries/management.py:418` — The `injury_set_new` command explicitly skips verifying that the invoking user actually owns the team the player is on. The comment reads: `# TODO: Add team ownership verification`. Any league player with the `Season 13 Players` role can currently set an injury on any player on any team without being blocked. ## File Locations - `commands/injuries/management.py:418` ## Labels security, bug, todo ## Priority high

cal referenced this issue

2026-03-01 22:10:20 +00:00

Add team ownership verification to /injury set-new #17

cal referenced this issue from a commit

2026-03-01 22:18:38 +00:00

feat: add team ownership verification to /injury set-new and /injury clear (closes #18)

cal referenced a pull request that will close this issue

2026-03-01 22:18:51 +00:00

feat: add team ownership verification to /injury commands (closes #18) #53

cal referenced this issue from a commit

2026-03-01 22:41:06 +00:00

feat: add team ownership verification to /injury set-new and /injury clear (closes #18)