fix: Server error when invalid 'sort' field is passed from an API client (#2000)

2021-03-31 18:54:02 -07:00
parent 2e64972574
commit 2ef0caba88
8 changed files with 34 additions and 4 deletions
--- a/server/api/shares.js
+++ b/server/api/shares.js
@ -44,6 +44,7 @@ router.post("shares.info", auth(), async (ctx) => {
 router.post("shares.list", auth(), pagination(), async (ctx) => {
  let { sort = "updatedAt", direction } = ctx.body;
  if (direction !== "ASC") direction = "DESC";
+  ctx.assertSort(sort, Share);

  const user = ctx.state.user;
  const where = {