Potential security issue in positive routes

[arvindsankariitm]

The mark_duplicate route (and a few others) in our Flask application allows any user to mark any ticket as a duplicate when only the user who created the ticket should be able to mark it as such. This poses a security vulnerability as it could potentially allow users to mark tickets created by other users as solved.

We need to update this route to ensure that only the user who created the ticket can mark it as a duplicate. We should also consider implementing additional security measures such as input validation to prevent any malicious input from users.

[cdxpb]

yes, please implement that. i've also changed some of the routes to no longer accept user_id from the api requests but use the authentication to get user_id of the current user. this particular issue should be resolved by checking if current_user.id == ticket.user_id