いい感じにした

1 files changed, 15 insertions, 8 deletions

diff --git a/src/api/endpoints/drive/folders/update.js b/src/api/endpoints/drive/folders/update.js
index d04173158d..475cd205df 100644
--- a/src/api/endpoints/drive/folders/update.js
+++ b/src/api/endpoints/drive/folders/update.js
@@ -25,6 +25,11 @@ module.exports = (params, user) =>
 		return rej('folder_id is required');
 	}
 
+	// Validate id
+	if (!mongo.ObjectID.isValid(folderId)) {
+		return rej('incorrect folder_id');
+	}
+
 	// Fetch folder
 	const folder = await DriveFolder
 		.findOne({
@@ -49,17 +54,19 @@ module.exports = (params, user) =>
 
 	// Get 'parent_id' parameter
 	let parentId = params.parent_id;
-	if (parentId !== undefined && parentId !== 'null') {
-		parentId = new mongo.ObjectID(parentId);
-	}
-
-	let parent = null;
-	if (parentId !== undefined && parentId !== null) {
-		if (parentId === 'null') {
+	if (parentId !== undefined) {
+		if (parentId === null) {
 			folder.parent_id = null;
 		} else {
+			// Validate id
+			if (!mongo.ObjectID.isValid(parentId)) {
+				return rej('incorrect parent_id');
+			}
+
+			parentId = new mongo.ObjectID(parentId);
+
 			// Get parent folder
-			parent = await DriveFolder
+			const parent = await DriveFolder
 				.findOne({
 					_id: parentId,
 					user_id: user._id