account switch – extra protection for editor

routes/profileEditor.vue

@@ -452,6 +452,8 @@
                 this.saving = true;
                 try {
                     await this.$post(`/profile/save`, {
+                        username: this.$user().username,
+
                         opinions: this.opinions,
                         names: this.names,
                         pronouns: this.pronouns,

server/routes/profile.js

@@ -526,6 +526,10 @@ router.post('/profile/save', handleErrorAsync(async (req, res) => {
         return res.status(401).json({error: 'Unauthorised'});
     }
 
+    if (req.body.username && req.user.username !== req.body.username) {
+        return res.status(401).json({error: 'Payload username does not match the token'});
+    }
+
     if (!Array.isArray(req.body.names)) {
         // service worker cache sends v1 requests
         req.body = upgradeToV2(req.body);