From d62fedd24472576a86173878491d6b92159255aa Mon Sep 17 00:00:00 2001
From: anupamme <mediratta@gmail.com>
Date: Mon, 14 Sep 2026 08:32:25 +0000
Subject: [PATCH] fix: fix security issue in api-server.js

The DELETE endpoint for removing messages from the queue lacks authentication and authorization checks
---
 lib/api-server.js | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/api-server.js b/lib/api-server.js
index cc6b2e10..a6029174 100644
--- a/lib/api-server.js
+++ b/lib/api-server.js
@@ -501,6 +501,14 @@ class APIServer {
 
         // Deletes a message from the queue
         this.server.del('/message/:id/:seq', (req, res, next) => {
+            if (config.api.user || config.api.pass) {
+                if (!req.username || req.username !== config.api.user || !req.authorization.basic || req.authorization.basic.password !== config.api.pass) {
+                    res.json(403, {
+                        error: 'Authentication required'
+                    });
+                    return next();
+                }
+            }
             if (!this.queue) {
                 res.json(500, {
                     error: 'Service not yet started'