fix: permissions bug related to deleting language mappings

routes/settings.go

@@ -115,13 +115,17 @@ func (h *SettingsHandler) DeleteLanguageMapping(w http.ResponseWriter, r *http.R
 		return
 	}
 
-	mapping := &models.LanguageMapping{
-		ID:     uint(id),
-		UserID: user.ID,
+	if mapping, err := h.languageMappingSrvc.GetById(uint(id)); err != nil || mapping == nil {
+		w.WriteHeader(http.StatusNotFound)
+		templates[conf.SettingsTemplate].Execute(w, h.buildViewModel(r).WithError("mapping not found"))
+		return
+	} else if mapping.UserID != user.ID {
+		w.WriteHeader(http.StatusForbidden)
+		templates[conf.SettingsTemplate].Execute(w, h.buildViewModel(r).WithError("not allowed to delete mapping"))
+		return
 	}
 
-	err = h.languageMappingSrvc.Delete(mapping)
-	if err != nil {
+	if err := h.languageMappingSrvc.Delete(&models.LanguageMapping{ID: uint(id)}); err != nil {
 		w.WriteHeader(http.StatusInternalServerError)
 		templates[conf.SettingsTemplate].Execute(w, h.buildViewModel(r).WithError("could not delete mapping"))
 		return

views/settings.tpl.html

@@ -89,7 +89,7 @@
                 <form class="float-right" action="settings/language_mappings/delete" method="post">
                     <input type="hidden" id="mapping_id" name="mapping_id" required value="{{ $mapping.ID }}">
                     <button type="submit" class="py-1 px-3 rounded bg-red-500 hover:bg-red-600 text-white text-sm">
-                        Remove
+                        X
                     </button>
                 </form>
             </div>