fix: Server error when invalid 'sort' field is passed from an API client (#2000)

2021-03-31 18:54:02 -07:00
parent 2e64972574
commit 2ef0caba88
8 changed files with 34 additions and 4 deletions
--- a/server/api/revisions.js
+++ b/server/api/revisions.js
@ -34,6 +34,7 @@ router.post("revisions.info", auth(), async (ctx) => {
 router.post("revisions.list", auth(), pagination(), async (ctx) => {
  let { documentId, sort = "updatedAt", direction } = ctx.body;
  if (direction !== "ASC") direction = "DESC";
+  ctx.assertSort(sort, Revision);
  ctx.assertPresent(documentId, "documentId is required");

  const user = ctx.state.user;