Fixed SECURITY: User can claim ribbon without being in group

[Shiro]

A user who requests to join a group can use its ribbon without being approved

 

[Shiro]

@Nobita

 

[Freelancer]

 

[Truonglv]

Now it is safe . Thanks