Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2026-07-10 22:51:35 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: #8179, limit length of location/website/fullname, check grouptitle

Browse Source
This commit is contained in:
Barış Soner Uşaklı
2020-02-24 16:58:51 -05:00
parent 307c72a58b
commit 14e7866745
1 changed files with 26 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
src/user/profile.js
View File

@@ -111,6 +111,9 @@ module.exports = function (User) {
if (!data.website) { if (!data.website) {
return; return;
} }
if (data.website.length > 255) {
throw new Error('[[error:invalid-website]]');
}
await User.checkMinReputation(callerUid, data.uid, 'min:rep:website'); await User.checkMinReputation(callerUid, data.uid, 'min:rep:website');
} }
@@ -136,13 +139,13 @@ module.exports = function (User) {
} }
function isFullnameValid(data) { function isFullnameValid(data) {
if (data.fullname && validator.isURL(data.fullname)) { if (data.fullname && (validator.isURL(data.fullname) || data.fullname.length > 255)) {
throw new Error('[[error:invalid-fullname]]'); throw new Error('[[error:invalid-fullname]]');
} }
} }
function isLocationValid(data) { function isLocationValid(data) {
if (data.location && validator.isURL(data.location)) { if (data.location && (validator.isURL(data.location) || data.location.length > 255)) {
throw new Error('[[error:invalid-location]]'); throw new Error('[[error:invalid-location]]');
} }
} }
@@ -159,8 +162,27 @@ module.exports = function (User) {
} }
function isGroupTitleValid(data) { function isGroupTitleValid(data) {
if (data.groupTitle === 'registered-users' || groups.isPrivilegeGroup(data.groupTitle)) { function checkTitle(title) {
throw new Error('[[error:invalid-group-title]]'); if (title === 'registered-users' || groups.isPrivilegeGroup(title)) {
throw new Error('[[error:invalid-group-title]]');
}
}
if (!data.groupTitle) {
return;
}
let groupTitles = [];
if (validator.isJSON(data.groupTitle)) {
groupTitles = JSON.parse(data.groupTitle);
if (!Array.isArray(groupTitles)) {
throw new Error('[[error:invalid-group-title]]');
}
groupTitles.forEach(title => checkTitle(title));
} else {
groupTitles = [data.groupTitle];
checkTitle(data.groupTitle);
}
if (!meta.config.allowMultipleBadges && groupTitles.length > 1) {
data.groupTitle = JSON.stringify(groupTitles[0]);
} }
} }