diff --git a/server/api/documents.js b/server/api/documents.js index 099751d7..5cf4a3b2 100644 --- a/server/api/documents.js +++ b/server/api/documents.js @@ -174,6 +174,9 @@ router.post('documents.info', auth({ required: false }), async ctx => { }, ], }); + if (!share) { + throw new InvalidRequestError('Document could not be found for shareId'); + } document = share.document; } else { document = await Document.findById(id); diff --git a/server/api/documents.test.js b/server/api/documents.test.js index e38f1a2c..86aa3533 100644 --- a/server/api/documents.test.js +++ b/server/api/documents.test.js @@ -73,6 +73,13 @@ describe('#documents.info', async () => { expect(body.data.createdBy.id).toEqual(user.id); expect(body.data.updatedBy.id).toEqual(user.id); }); + + it('should require a valid shareId', async () => { + const res = await server.post('/api/documents.info', { + body: { shareId: 123 }, + }); + expect(res.status).toEqual(400); + }); }); describe('#documents.list', async () => {