diff options
author | Chocobozzz <me@florianbigard.com> | 2022-11-15 14:41:55 +0100 |
---|---|---|
committer | Chocobozzz <me@florianbigard.com> | 2022-11-15 14:41:55 +0100 |
commit | 4638cd713dcdd007cd7f49b9a95fa62ac7823e7c (patch) | |
tree | 3e341c6ebbd1ce9e2bbacd72e7e3793e0bd467c2 /server/middlewares/validators/shared/accounts.ts | |
parent | 6bcb559fc9a491fc3ce83e7c077ee9dc742b1d63 (diff) | |
download | PeerTube-4638cd713dcdd007cd7f49b9a95fa62ac7823e7c.tar.gz PeerTube-4638cd713dcdd007cd7f49b9a95fa62ac7823e7c.tar.zst PeerTube-4638cd713dcdd007cd7f49b9a95fa62ac7823e7c.zip |
Don't inject untrusted input
Even if it's already checked in middlewares
It's better to have safe modals too
Diffstat (limited to 'server/middlewares/validators/shared/accounts.ts')
-rw-r--r-- | server/middlewares/validators/shared/accounts.ts | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/server/middlewares/validators/shared/accounts.ts b/server/middlewares/validators/shared/accounts.ts index fe4f83aa0..72b0e235e 100644 --- a/server/middlewares/validators/shared/accounts.ts +++ b/server/middlewares/validators/shared/accounts.ts | |||
@@ -2,10 +2,11 @@ import { Response } from 'express' | |||
2 | import { AccountModel } from '@server/models/account/account' | 2 | import { AccountModel } from '@server/models/account/account' |
3 | import { UserModel } from '@server/models/user/user' | 3 | import { UserModel } from '@server/models/user/user' |
4 | import { MAccountDefault } from '@server/types/models' | 4 | import { MAccountDefault } from '@server/types/models' |
5 | import { forceNumber } from '@shared/core-utils' | ||
5 | import { HttpStatusCode } from '@shared/models' | 6 | import { HttpStatusCode } from '@shared/models' |
6 | 7 | ||
7 | function doesAccountIdExist (id: number | string, res: Response, sendNotFound = true) { | 8 | function doesAccountIdExist (id: number | string, res: Response, sendNotFound = true) { |
8 | const promise = AccountModel.load(parseInt(id + '', 10)) | 9 | const promise = AccountModel.load(forceNumber(id)) |
9 | 10 | ||
10 | return doesAccountExist(promise, res, sendNotFound) | 11 | return doesAccountExist(promise, res, sendNotFound) |
11 | } | 12 | } |
@@ -40,7 +41,7 @@ async function doesAccountExist (p: Promise<MAccountDefault>, res: Response, sen | |||
40 | } | 41 | } |
41 | 42 | ||
42 | async function doesUserFeedTokenCorrespond (id: number, token: string, res: Response) { | 43 | async function doesUserFeedTokenCorrespond (id: number, token: string, res: Response) { |
43 | const user = await UserModel.loadByIdWithChannels(parseInt(id + '', 10)) | 44 | const user = await UserModel.loadByIdWithChannels(forceNumber(id)) |
44 | 45 | ||
45 | if (token !== user.feedToken) { | 46 | if (token !== user.feedToken) { |
46 | res.fail({ | 47 | res.fail({ |