Added vuln

routes/index.js

@@ -51,6 +51,23 @@ exports.loginHandler = function (req, res, next) {
   }
 };
 
+exports.loginHandlersssss = function (req, res, next) {
+  if (validator.isEmail(req.body.username)) {
+    User.find({ username: req.body.username, password: req.body.password }, function (err, users) {
+      if (users.length > 0) {
+        const redirectPage = req.body.redirectPage
+        const session = req.session
+        const username = req.body.username
+        return adminLoginSuccess(redirectPage, session, username, res)
+      } else {
+        return res.status(401).send()
+      }
+    });
+  } else {
+    return res.status(401).send()
+  }
+};
+
 function adminLoginSuccess(redirectPage, session, username, res) {
   session.loggedIn = 1
 
@@ -86,6 +103,32 @@ exports.get_account_details = function(req, res, next) {
  	return res.render('account.hbs', profile)
 }
 
+exports.save_account_detail = function(req, res, next) {
+  // get the profile details from the JSON
+	const profile = req.body
+  // validate the input
+  if (validator.isEmail(profile.email, { allow_display_name: true })
+    // allow_display_name allows us to receive input as:
+    // Display Name <email-address>
+    // which we consider valid too
+    && validator.isMobilePhone(profile.phone, 'he-IL')
+    && validator.isAscii(profile.firstname)
+    && validator.isAscii(profile.lastname)
+    && validator.isAscii(profile.country)
+  ) {
+    // trim any extra spaces on the right of the name
+    profile.firstname = validator.rtrim(profile.firstname)
+    profile.lastname = validator.rtrim(profile.lastname)
+
+    // render the view
+    return res.render('account.hbs', profile)
+  } else {
+    // if input validation fails, we just render the view as is
+    console.log('error in form details')
+    return res.render('account.hbs')
+  }
+}
+
 exports.save_account_details = function(req, res, next) {
   // get the profile details from the JSON
 	const profile = req.body