Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2026-01-25 08:49:51 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: escape config.userLang/acpLang, don't allow invalid language codes

Browse Source
This commit is contained in:
Barış Soner Uşaklı
2020-01-13 12:27:50 -05:00
parent df5e3a7394
commit e06c1bfcd2
4 changed files with 35 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/controllers/api.js
View File

@@ -86,8 +86,8 @@ apiController.loadConfig = async function (req) {
config.usePagination = settings.usePagination;
config.topicsPerPage = settings.topicsPerPage;
config.postsPerPage = settings.postsPerPage;
config.userLang = (req.query.lang ? validator.escape(String(req.query.lang)) : null) || settings.userLang || config.defaultLang;
config.acpLang = (req.query.lang ? validator.escape(String(req.query.lang)) : null) || settings.acpLang;
config.userLang = validator.escape(String((req.query.lang ? req.query.lang : null) || settings.userLang || config.defaultLang));
config.acpLang = validator.escape(String((req.query.lang ? req.query.lang : null) || settings.acpLang));
config.openOutgoingLinksInNewTab = settings.openOutgoingLinksInNewTab;
config.topicPostSort = settings.topicPostSort || config.topicPostSort;
config.categoryTopicSort = settings.categoryTopicSort || config.categoryTopicSort;

8
src/user/settings.js
View File

@@ -5,6 +5,7 @@ const meta = require('../meta');
const db = require('../database');
const plugins = require('../plugins');
const notifications = require('../notifications');
const languages = require('../languages');
module.exports = function (User) {
User.getSettings = async function (uid) {
@@ -87,6 +88,13 @@ module.exports = function (User) {
throw new Error('[[error:invalid-pagination-value, 2, ' + maxTopicsPerPage + ']]');
}
const languageCodes = await languages.listCodes();
if (data.userLang && !languageCodes.includes(data.userLang)) {
throw new Error('[[error:invalid-language]]');
}
if (data.acpLang && !languageCodes.includes(data.acpLang)) {
throw new Error('[[error:invalid-language]]');
}
data.userLang = data.userLang || meta.config.defaultLang;
plugins.fireHook('action:user.saveSettings', { uid: uid, settings: data });