fix: bad errors on malformed account's API calls
Massimo Melina committed
Apr 20, 2024 at 15:38 UTC
b61eff6ce28a2c64b4ae31ca06098cd75de3a066
1 file changed
+6
src/api.accounts.ts
+6
@@ -6,6 +6,7 @@ import { Account, accountCanLoginAdmin, accountHasPassword, accountsConfig, addA
6
import _ from 'lodash'
7
import { HTTP_BAD_REQUEST, HTTP_CONFLICT, HTTP_NOT_FOUND } from './const'
8
import { getCurrentUsername, invalidSessions } from './auth'
9
+import { apiAssertTypes } from './misc'
10
11
export type AccountAdminSend = NonNullable<ReturnType<typeof prepareAccount>>
12
function prepareAccount(ac: Account | undefined) {
@@ -38,6 +39,7 @@ export default {
39
},
40
41
async set_account({ username, changes }, ctx) {
42
+ apiAssertTypes({ string: { username } })
43
const acc = getAccount(username)
44
if (!acc)
45
return new ApiError(HTTP_BAD_REQUEST)
@@ -48,6 +50,7 @@ export default {
50
},
51
52
async add_account({ overwrite, username, ...rest }) {
53
+ apiAssertTypes({ string: { username } })
54
const existing = getAccount(username)
55
if (existing) {
56
if (!overwrite) return new ApiError(HTTP_CONFLICT)
@@ -59,15 +62,18 @@ export default {
62
},
63
64
del_account({ username }) {
65
+ apiAssertTypes({ string: { username } })
66
return delAccount(username) ? {} : new ApiError(HTTP_BAD_REQUEST)
67
},
68
69
invalidate_sessions({ username }) {
70
+ apiAssertTypes({ string: { username } })
71
invalidSessions.add(username)
72
return {}
73
},
74
75
async change_srp({ username, salt, verifier }) {
76
+ apiAssertTypes({ string: { username, salt, verifier } })
77
const a = getAccount(username)
78
return a ? changeSrpHelper(a, salt, verifier)
79
: new ApiError(HTTP_NOT_FOUND)