Skip to content

Commit

Permalink
fix validation
Browse files Browse the repository at this point in the history
  • Loading branch information
miya committed Sep 11, 2024
1 parent b4b6d45 commit 12f7061
Showing 1 changed file with 12 additions and 12 deletions.
24 changes: 12 additions & 12 deletions apps/app/src/server/routes/apiv3/page/index.ts
Original file line number Diff line number Diff line change
Expand Up @@ -291,25 +291,25 @@ module.exports = (crowi) => {
pageId, path, findAll, revisionId, shareLinkId,
} = req.query;

if (pageId == null && path == null) {
return res.apiv3Err(new ErrorV3('Either parameter of path or pageId is required.', 'invalid-request'));
if (isSharedPage && path != null) {
return res.apiv3Err(new ErrorV3('Either parameter of (pageId or path) or (pageId and shareLinkId) is required.', 'invalid-request'));
}

if (isSharedPage) {
const shareLink = await ShareLink.findOne({ _id: shareLinkId }).populate('relatedPage');
if (shareLink == null) {
return res.apiv3Err(new ErrorV3('ShareLink is not found'), 404);
}

const relatedPage = await Page.findOne({ _id: getIdForRef(shareLink.relatedPage) });
const pagePopulateDataToShowRevision = await relatedPage?.populateDataToShowRevision();
return res.apiv3({ page: pagePopulateDataToShowRevision });
if (!isSharedPage && (pageId == null && path == null)) {
return res.apiv3Err(new ErrorV3('Either parameter of (pageId or path) or (pageId and shareLinkId) is required.', 'invalid-request'));
}

let page;
let pages;
try {
if (pageId != null) { // prioritized
if (isSharedPage) {
const shareLink = await ShareLink.findOne({ _id: shareLinkId }).populate('relatedPage');

Check failure

Code scanning / CodeQL

Database query built from user-controlled sources High

This query object depends on a
user-provided value
.
if (shareLink == null) {
throw new Error('ShareLink is not found');
}
page = await Page.findOne({ _id: getIdForRef(shareLink.relatedPage) });
}
else if (pageId != null) { // prioritized
page = await Page.findByIdAndViewer(pageId, user);
}
else if (!findAll) {
Expand Down

0 comments on commit 12f7061

Please sign in to comment.