diff options
Diffstat (limited to 'src/api')
| -rw-r--r-- | src/api/endpoints/following/create.js | 5 | ||||
| -rw-r--r-- | src/api/endpoints/following/delete.js | 5 |
2 files changed, 10 insertions, 0 deletions
diff --git a/src/api/endpoints/following/create.js b/src/api/endpoints/following/create.js index 90a6da9838..4a796b11a4 100644 --- a/src/api/endpoints/following/create.js +++ b/src/api/endpoints/following/create.js @@ -28,6 +28,11 @@ module.exports = (params, user) => return rej('user_id is required'); } + // Validate id + if (!mongo.ObjectID.isValid(userId)) { + return rej('incorrect user_id'); + } + // 自分自身 if (user._id.equals(userId)) { return rej('followee is yourself'); diff --git a/src/api/endpoints/following/delete.js b/src/api/endpoints/following/delete.js index 9bb1b082e9..2da20dea38 100644 --- a/src/api/endpoints/following/delete.js +++ b/src/api/endpoints/following/delete.js @@ -27,6 +27,11 @@ module.exports = (params, user) => return rej('user_id is required'); } + // Validate id + if (!mongo.ObjectID.isValid(userId)) { + return rej('incorrect user_id'); + } + // Check if the followee is yourself if (user._id.equals(userId)) { return rej('followee is yourself'); |