diff options
author | Chocobozzz <me@florianbigard.com> | 2022-11-15 14:41:55 +0100 |
---|---|---|
committer | Chocobozzz <me@florianbigard.com> | 2022-11-15 14:41:55 +0100 |
commit | 4638cd713dcdd007cd7f49b9a95fa62ac7823e7c (patch) | |
tree | 3e341c6ebbd1ce9e2bbacd72e7e3793e0bd467c2 /server/controllers/api/users/my-history.ts | |
parent | 6bcb559fc9a491fc3ce83e7c077ee9dc742b1d63 (diff) | |
download | PeerTube-4638cd713dcdd007cd7f49b9a95fa62ac7823e7c.tar.gz PeerTube-4638cd713dcdd007cd7f49b9a95fa62ac7823e7c.tar.zst PeerTube-4638cd713dcdd007cd7f49b9a95fa62ac7823e7c.zip |
Don't inject untrusted input
Even if it's already checked in middlewares
It's better to have safe modals too
Diffstat (limited to 'server/controllers/api/users/my-history.ts')
-rw-r--r-- | server/controllers/api/users/my-history.ts | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/server/controllers/api/users/my-history.ts b/server/controllers/api/users/my-history.ts index bc5b40f59..e6d3e86ac 100644 --- a/server/controllers/api/users/my-history.ts +++ b/server/controllers/api/users/my-history.ts | |||
@@ -1,3 +1,4 @@ | |||
1 | import { forceNumber } from '@shared/core-utils' | ||
1 | import express from 'express' | 2 | import express from 'express' |
2 | import { HttpStatusCode } from '../../../../shared/models/http/http-error-codes' | 3 | import { HttpStatusCode } from '../../../../shared/models/http/http-error-codes' |
3 | import { getFormattedObjects } from '../../../helpers/utils' | 4 | import { getFormattedObjects } from '../../../helpers/utils' |
@@ -55,7 +56,7 @@ async function listMyVideosHistory (req: express.Request, res: express.Response) | |||
55 | async function removeUserHistoryElement (req: express.Request, res: express.Response) { | 56 | async function removeUserHistoryElement (req: express.Request, res: express.Response) { |
56 | const user = res.locals.oauth.token.User | 57 | const user = res.locals.oauth.token.User |
57 | 58 | ||
58 | await UserVideoHistoryModel.removeUserHistoryElement(user, parseInt(req.params.videoId + '')) | 59 | await UserVideoHistoryModel.removeUserHistoryElement(user, forceNumber(req.params.videoId)) |
59 | 60 | ||
60 | return res.sendStatus(HttpStatusCode.NO_CONTENT_204) | 61 | return res.sendStatus(HttpStatusCode.NO_CONTENT_204) |
61 | } | 62 | } |