From bf68c9dc64e2e608df1c54810bcebee520482757 Mon Sep 17 00:00:00 2001
From: zkldi <20380519+zkldi@users.noreply.github.com>
Date: Thu, 16 Dec 2021 04:09:50 +0000
Subject: [PATCH] Fix potential crash in POST /api/v1/import/orphans if request
 was made without self-key permissions.

---
 server/src/server/router/api/v1/import/router.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/src/server/router/api/v1/import/router.ts b/server/src/server/router/api/v1/import/router.ts
index 5cba19143..c888efb31 100644
--- a/server/src/server/router/api/v1/import/router.ts
+++ b/server/src/server/router/api/v1/import/router.ts
@@ -162,7 +162,7 @@ router.post(
  * @name POST /api/v1/import/orphans
  */
 router.post("/orphans", RequirePermissions("submit_score"), async (req, res) => {
-	const userDoc = await GetUserWithIDGuaranteed(req.session.tachi!.user.id);
+	const userDoc = await GetUserWithIDGuaranteed(req[SYMBOL_TachiAPIAuth].userID!);
 
 	logger.info(`User ${FormatUserDoc(userDoc)} forced an orphan sync.`);