fix(server): do not allow merging a person into themselves (#10776)

This commit is contained in:
Jason Rasmussen
2024-07-02 15:56:05 -04:00
committed by GitHub
parent aa29f5d69c
commit 6a11464d60
2 changed files with 21 additions and 0 deletions

View File

@@ -551,6 +551,10 @@ export class PersonService {
async mergePerson(auth: AuthDto, id: string, dto: MergePersonDto): Promise<BulkIdResponseDto[]> {
const mergeIds = dto.ids;
if (mergeIds.includes(id)) {
throw new BadRequestException('Cannot merge a person into themselves');
}
await this.access.requirePermission(auth, Permission.PERSON_WRITE, id);
let primaryPerson = await this.findOrFail(id);
const primaryName = primaryPerson.name || primaryPerson.id;