Don't inject untrusted input

[github/Chocobozzz/PeerTube.git] / server / middlewares / validators / shared / users.ts

diff --git a/server/middlewares/validators/shared/users.ts b/server/middlewares/validators/shared/users.ts
index fbaa7db0e6009e7afd31d5ff921ba7f24b2498d9..b8f1436d331939c594087ab1fe27f939c5188602 100644 (file)
--- a/server/middlewares/validators/shared/users.ts
+++ b/server/middlewares/validators/shared/users.ts
@@ -2,10 +2,11 @@ import express from 'express'
 import { ActorModel } from '@server/models/actor/actor'
 import { UserModel } from '@server/models/user/user'
 import { MUserDefault } from '@server/types/models'
+import { forceNumber } from '@shared/core-utils'
 import { HttpStatusCode } from '@shared/models'
 
 function checkUserIdExist (idArg: number | string, res: express.Response, withStats = false) {
-  const id = parseInt(idArg + '', 10)
+  const id = forceNumber(idArg)
   return checkUserExist(() => UserModel.loadByIdWithChannels(id, withStats), res)
 }