1 files changed, 9 insertions, 4 deletions
diff --git a/src/main/ipcPlugins.ts b/src/main/ipcPlugins.ts
index 7ab4c25..bcc0a1b 100644
--- a/src/main/ipcPlugins.ts
+++ b/src/main/ipcPlugins.ts
@@ -20,7 +20,7 @@ import { IpcEvents } from "@utils/IpcEvents";
 import { app, ipcMain } from "electron";
 import { readFile } from "fs/promises";
 import { request } from "https";
-import { join } from "path";
+import { basename, normalize } from "path";
 
 // #region OpenInApp
 // These links don't support CORS, so this has to be native
@@ -49,10 +49,15 @@ ipcMain.handle(IpcEvents.OPEN_IN_APP__RESOLVE_REDIRECT, async (_, url: string) =
 
 
 // #region VoiceMessages
-ipcMain.handle(IpcEvents.VOICE_MESSAGES_READ_RECORDING, async () => {
-    const path = join(app.getPath("userData"), "module_data/discord_voice/recording.ogg");
+ipcMain.handle(IpcEvents.VOICE_MESSAGES_READ_RECORDING, async (_, filePath: string) => {
+    filePath = normalize(filePath);
+    const filename = basename(filePath);
+    const discordBaseDirWithTrailingSlash = normalize(app.getPath("userData") + "/");
+    console.log(filename, discordBaseDirWithTrailingSlash, filePath);
+    if (filename !== "recording.ogg" || !filePath.startsWith(discordBaseDirWithTrailingSlash)) return null;
+
     try {
-        const buf = await readFile(path);
+        const buf = await readFile(filePath);
         return new Uint8Array(buf.buffer);
     } catch {
         return null;