Don't inject untrusted input

Even if it's already checked in middlewares
It's better to have safe modals too

1 files changed, 3 insertions, 2 deletions

diff --git a/server/middlewares/pagination.ts b/server/middlewares/pagination.ts
index 9812af9e4..17e43f743 100644
--- a/server/middlewares/pagination.ts
+++ b/server/middlewares/pagination.ts
@@ -1,12 +1,13 @@
 import express from 'express'
+import { forceNumber } from '@shared/core-utils'
 import { PAGINATION } from '../initializers/constants'
 
 function setDefaultPagination (req: express.Request, res: express.Response, next: express.NextFunction) {
   if (!req.query.start) req.query.start = 0
-  else req.query.start = parseInt(req.query.start, 10)
+  else req.query.start = forceNumber(req.query.start)
 
   if (!req.query.count) req.query.count = PAGINATION.GLOBAL.COUNT.DEFAULT
-  else req.query.count = parseInt(req.query.count, 10)
+  else req.query.count = forceNumber(req.query.count)
 
   return next()
 }