moris/misskey
1
0
Fork 0
forked from mirror/misskey
Code Pull Requests Activity

[API] Fix: Validate id

Browse Source
This commit is contained in:
syuilo 2017-01-18 06:32:50 +09:00
parent 46e85e5cc3
commit 2f596948f3
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/api/endpoints/users/show.js
View File

@ -33,6 +33,11 @@ module.exports = (params, me) =>
return rej('user_id or username is required'); return rej('user_id or username is required');
} }
// Validate id
if (userId && !mongo.ObjectID.isValid(userId)) {
return rej('incorrect user_id');
}
// Lookup user // Lookup user
const user = userId !== null const user = userId !== null
? await User.findOne({ _id: new mongo.ObjectID(userId) }) ? await User.findOne({ _id: new mongo.ObjectID(userId) })