From 91962cc90b7ae5e12c05e1dde0ff63dc764a5151 Mon Sep 17 00:00:00 2001
From: Carina Wollendorfer <30310907+CarinaWolli@users.noreply.github.com>
Date: Fri, 9 Jun 2023 13:18:59 +0200
Subject: [PATCH] check that input teamId equals webhook team (#9434)

Co-authored-by: CarinaWolli <wollencarina@gmail.com>
---
 packages/trpc/server/routers/viewer/webhook/util.ts | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/packages/trpc/server/routers/viewer/webhook/util.ts b/packages/trpc/server/routers/viewer/webhook/util.ts
index a898a8d273..971c60fb4b 100644
--- a/packages/trpc/server/routers/viewer/webhook/util.ts
+++ b/packages/trpc/server/routers/viewer/webhook/util.ts
@@ -45,6 +45,18 @@ export const webhookProcedure = authedProcedure
       });
 
       if (webhook) {
+        if (teamId && teamId !== webhook.teamId) {
+          throw new TRPCError({
+            code: "UNAUTHORIZED",
+          });
+        }
+
+        if (eventTypeId && eventTypeId !== webhook.eventTypeId) {
+          throw new TRPCError({
+            code: "UNAUTHORIZED",
+          });
+        }
+
         if (webhook.teamId) {
           const user = await prisma.user.findFirst({
             where: {