rxbn_/auth.rxbn.de
1
0
Fork 0
Code Releases Activity

db - sanitize input

Browse Source
This commit is contained in:
Ruben Meyer 2020-02-29 21:16:48 +01:00
parent f895af3890
commit 2225d8a33e
2 changed files with 13 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
bin/database/module.js
View File

@ -9,6 +9,7 @@
// init // init
var mongoose = require('mongoose'); var mongoose = require('mongoose');
var sanitize = require('mongo-sanitize');
var crypto = require('crypto'); var crypto = require('crypto');
var methods = {}; var methods = {};
@ -63,10 +64,10 @@ methods.addUser = (nick, email, passhash, group, callback) => {
let userModel = models.user; let userModel = models.user;
let user = new userModel(); let user = new userModel();
user.nickname = nick; user.nickname = sanitize(nick);
user.email = email; user.email = sanitize(email);
user.passhash = passhash; user.passhash = sanitize(passhash);
user.group = group; user.group = sanitize(group);
user.save((err) => { user.save((err) => {
if(!err) callback(null, 1); if(!err) callback(null, 1);
@ -88,6 +89,9 @@ methods.delUser = (haystack, callback) => {
let userModel = models.user; let userModel = models.user;
// sanitize input
haystack = sanitize(haystack);
userModel.findOneAndDelete().or([{nickname: haystack}, {email: haystack}]) userModel.findOneAndDelete().or([{nickname: haystack}, {email: haystack}])
.then((rep) => { .then((rep) => {
// TODO delete user // TODO delete user
@ -132,6 +136,9 @@ methods.getUser = (haystack, callback) => {
let userModel = models.user; let userModel = models.user;
// sanitize input
haystack = sanitize(haystack);
let or = []; let or = [];
if(typeof haystack === 'string') { if(typeof haystack === 'string') {
or = [{nickname: haystack}, {email: haystack}, {token: haystack}]; or = [{nickname: haystack}, {email: haystack}, {token: haystack}];

1
package.json
View File

@ -11,6 +11,7 @@
"cookie-parser": "^1.4.4", "cookie-parser": "^1.4.4",
"express": "^4.17.1", "express": "^4.17.1",
"express-session": "^1.16.1", "express-session": "^1.16.1",
"mongo-sanitize": "^1.0.1",
"mongoose": "^5.5.12", "mongoose": "^5.5.12",
"pug": "^2.0.3", "pug": "^2.0.3",
"request": "^2.88.0", "request": "^2.88.0",