From 4927f815b5928956b60b761d95963386feb8db5b Mon Sep 17 00:00:00 2001
From: zkldi <20380519+zkldi@users.noreply.github.com>
Date: Sun, 20 Mar 2022 14:58:03 +0000
Subject: [PATCH] bug: Force Static Import should actually matter.

---
 .../src/server/router/ir/fervidex/router.test.ts  | 15 +++++++++++++++
 server/src/server/router/ir/fervidex/router.ts    |  9 ++++++++-
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/server/src/server/router/ir/fervidex/router.test.ts b/server/src/server/router/ir/fervidex/router.test.ts
index f80361666..b5a3dbec5 100644
--- a/server/src/server/router/ir/fervidex/router.test.ts
+++ b/server/src/server/router/ir/fervidex/router.test.ts
@@ -457,5 +457,20 @@ t.test("POST /ir/fervidex/profile/submit", (t) => {
 		t.end();
 	});
 
+	t.test("Should disallow requests from non INF2 if forceStaticImport is false.", async (t) => {
+		await db["fer-settings"].update({ userID: 1 }, { $set: { forceStaticImport: false } });
+
+		const res = await mockApi
+			.post("/ir/fervidex/profile/submit")
+			.set("Authorization", "Bearer mock_token")
+			.set("User-Agent", "fervidex/1.3.0")
+			.set("X-Software-Model", "LDJ:J:B:A:2020092900")
+			.send(ferStaticBody);
+
+		t.equal(res.statusCode, 400, "Should be rejected, as FSI is not set.");
+
+		t.end();
+	});
+
 	t.end();
 });
diff --git a/server/src/server/router/ir/fervidex/router.ts b/server/src/server/router/ir/fervidex/router.ts
index fa81417b8..d606bd9e1 100644
--- a/server/src/server/router/ir/fervidex/router.ts
+++ b/server/src/server/router/ir/fervidex/router.ts
@@ -92,7 +92,14 @@ const RequireInf2ModelHeaderOrForceStatic: RequestHandler = async (req, res, nex
 	}
 
 	try {
-		ParseEA3SoftID(swModel);
+		const { model } = ParseEA3SoftID(swModel);
+
+		if (model !== MODEL_INFINITAS_2) {
+			return res.status(400).json({
+				success: false,
+				error: `Refusing to perform static import from non-infinitas client. To do this anyway, enable Force Static Import.`,
+			});
+		}
 	} catch (err) {
 		logger.info(`Invalid softID from ${req[SYMBOL_TachiAPIAuth].userID!}.`, { err });
 		return res.status(400).json({