Insecure admin promotion

[rnbguy]

I was trying to implement password-protected rooms and I noticed, you promote users to admin a bit insecurely.

Radium/components/Chat.vue

Lines 87 to 108 in 4a2fdd4

	try {
	var res = await this.$axios.get(
	`${this.$config.BASE_URL}/api/auth/${code}`
	);
	this.$buefy.toast.open({
	duration: 1000,
	message: `Authenticated`,
	position: "is-top",
	type: "is-success"
	});
	this.$store.commit("isAdmin");
	this.$root.mySocket.emit("setAdmin", this.$store.state.user);
	this.message = "";
	} catch (error) {
	this.$buefy.toast.open({
	duration: 1000,
	message: `Incorrect Code`,
	position: "is-top",
	type: "is-danger"
	});
	this.message = "";
	}

Radium/io/index.js

Lines 70 to 74 in 4a2fdd4

	socket.on("setAdmin", user => {
	const u = users.find(obj => obj.id == socket.id);
	u.admin = true;
	io.emit("userList", users);
	});

I am not a Nodejs expert. but it seems, from the client-side, if someone injects calls for isAdmin and setAdmin without authentication, they can gain admin power.

Nonetheless, thanks for this awesome software.