From 9c34554baddb0fb50983c7aea3dd88d6dccaeb68 Mon Sep 17 00:00:00 2001
From: Max Litruv Boonzaayer <litruv@gmail.com>
Date: Fri, 17 Apr 2026 02:53:03 +1000
Subject: [PATCH] Security: prevent unauthorized plugin modifications

---
 .gitea/scripts/validate-pr.js | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/.gitea/scripts/validate-pr.js b/.gitea/scripts/validate-pr.js
index b32e044..b3b5e02 100644
--- a/.gitea/scripts/validate-pr.js
+++ b/.gitea/scripts/validate-pr.js
@@ -171,6 +171,29 @@ for (const file of changedFiles) {
       const content = await readFile(file, 'utf-8');
       const plugin = JSON.parse(content);
       
+      // Check if this plugin already exists on main
+      let isModification = false;
+      let originalAuthor = null;
+      
+      try {
+        const originalContent = await readFile(`../base/${file}`, 'utf-8');
+        const originalPlugin = JSON.parse(originalContent);
+        isModification = true;
+        originalAuthor = originalPlugin.author;
+      } catch {
+        // File doesn't exist on main, this is a new plugin
+        isModification = false;
+      }
+      
+      // If modifying existing plugin, MUST match original author
+      if (isModification) {
+        if (originalAuthor !== prAuthor) {
+          errors.push(`❌ ${file}: Cannot modify plugin owned by "${originalAuthor}" (you are "${prAuthor}")`);
+          continue;
+        }
+        console.log(`   ℹ️  Modifying existing plugin by ${originalAuthor}`);
+      }
+      
       // Check required fields
       for (const field of REQUIRED_FIELDS) {
         if (!plugin[field]) {
@@ -188,7 +211,7 @@ for (const file of changedFiles) {
         errors.push(`❌ ${file}: Invalid version format: ${plugin.version}`);
       }
       
-      // Check author matches PR creator (for new files)
+      // Check author matches PR creator
       if (plugin.author !== prAuthor) {
         errors.push(`❌ ${file}: Author "${plugin.author}" must match PR creator "${prAuthor}"`);
       }