[API] Fix: Validate id

This commit is contained in:
syuilo 2017-01-18 06:32:50 +09:00
parent 46e85e5cc3
commit 2f596948f3

View file

@ -33,6 +33,11 @@ module.exports = (params, me) =>
return rej('user_id or username is required'); return rej('user_id or username is required');
} }
// Validate id
if (userId && !mongo.ObjectID.isValid(userId)) {
return rej('incorrect user_id');
}
// Lookup user // Lookup user
const user = userId !== null const user = userId !== null
? await User.findOne({ _id: new mongo.ObjectID(userId) }) ? await User.findOne({ _id: new mongo.ObjectID(userId) })