Fix #335

lib/channel.js

@@ -1529,6 +1529,15 @@ Channel.prototype.handleQueue = function (user, data) {
     var type = data.type;
     var link = util.formatLink(id, type);
 
+    /* Kick for this because there's no legitimate way to do this with the
+       UI.  Can only be accomplished by manually sending a packet and people
+       abuse it to bypass the addnext permission
+    */
+    if (data.pos !== "next" && data.pos !== "end") {
+        user.kick("Illegal queue packet: pos must be 'next' or 'end'");
+        return;
+    }
+
     // Verify user has the permission to add at the position given
     if (data.pos === "next" && !this.hasPermission(user, "playlistnext")) {
         return;