fix: Check ACL

CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+# 0.17.1
+
+* Prevent endorsement PMs being sent when visibility is private
+* Prevent lemmy switching to mastodon proxy
+* Fediseer can now change the PM proxy
+
+# 0.17.0
+
+* Added instance state
+* Added has_captcha
+* Added approval_required
+* Added update.py
+
 # 0.16.2
 
 * Added way to retrieve misskey admins

fediseer/apis/v1/whitelist.py

@@ -173,6 +173,8 @@ class WhitelistDomain(Resource):
         instance_to_reset = database.find_instance_by_domain(domain)
         changed = False
         new_key = None
+        if requestor_instance != instance_to_reset and user.username != "fediseer":
+            raise e.Forbidden("Only an instance admin can modify the instance")
         if self.args.sysadmins is not None and instance.sysadmins != self.args.sysadmins:
             instance.sysadmins = self.args.sysadmins
             changed = True