From 4638cd713dcdd007cd7f49b9a95fa62ac7823e7c Mon Sep 17 00:00:00 2001 From: Chocobozzz Date: Tue, 15 Nov 2022 14:41:55 +0100 Subject: Don't inject untrusted input Even if it's already checked in middlewares It's better to have safe modals too --- server/models/video/video-channel.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'server/models/video/video-channel.ts') diff --git a/server/models/video/video-channel.ts b/server/models/video/video-channel.ts index 91dafbcf1..9e461b6ca 100644 --- a/server/models/video/video-channel.ts +++ b/server/models/video/video-channel.ts @@ -19,7 +19,7 @@ import { } from 'sequelize-typescript' import { CONFIG } from '@server/initializers/config' import { MAccountActor } from '@server/types/models' -import { pick } from '@shared/core-utils' +import { forceNumber, pick } from '@shared/core-utils' import { AttributesOnly } from '@shared/typescript-utils' import { ActivityPubActor } from '../../../shared/models/activitypub' import { VideoChannel, VideoChannelSummary } from '../../../shared/models/videos' @@ -280,7 +280,7 @@ export type SummaryOptions = { ] }, [ScopeNames.WITH_STATS]: (options: AvailableWithStatsOptions = { daysPrior: 30 }) => { - const daysPrior = parseInt(options.daysPrior + '', 10) + const daysPrior = forceNumber(options.daysPrior) return { attributes: { -- cgit v1.2.3