[Client] Resolve #3658

src/server/api/endpoints/drive/files/update.ts

@@ -57,14 +57,17 @@ export default define(meta, (ps, user) => new Promise(async (res, rej) => {
 	// Fetch file
 	const file = await DriveFile
 		.findOne({
-			_id: ps.fileId,
-			'metadata.userId': user._id
+			_id: ps.fileId
 		});
 
 	if (file === null) {
 		return rej('file-not-found');
 	}
 
+	if (!user.isAdmin && !user.isModerator && !file.metadata.userId.equals(user._id)) {
+		return rej('access denied');
+	}
+
 	if (ps.name) file.filename = ps.name;
 
 	if (ps.isSensitive !== undefined) file.metadata.isSensitive = ps.isSensitive;