mirror/ezbookkeeping
1
0
Fork 0
mirror of https://github.com/mayswind/ezbookkeeping.git synced 2026-05-20 09:44:26 +08:00
Code Issues Packages Projects Releases Wiki Activity

check whether query is valid before query user from database

Browse Source
This commit is contained in:
MaysWind
2024-08-11 12:09:53 +08:00
parent 5ab7d0e9b3
commit f4a27e59a3
1 changed files with 16 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/users.go
+16 -11
View File
@@ -725,7 +725,22 @@ func (a *UsersApi) UserSendVerifyEmailByLoginedUserHandler(c *core.Context) (any
// UserGetAvatarHandler returns user avatar data for current user // UserGetAvatarHandler returns user avatar data for current user
func (a *UsersApi) UserGetAvatarHandler(c *core.Context) ([]byte, string, *errs.Error) { func (a *UsersApi) UserGetAvatarHandler(c *core.Context) ([]byte, string, *errs.Error) {
fileName := c.Param("fileName")
fileExtension := utils.GetFileNameExtension(fileName)
contentType := utils.GetImageContentType(fileExtension)
if contentType == "" {
return nil, "", errs.ErrImageTypeNotSupported
}
uid := c.GetCurrentUid() uid := c.GetCurrentUid()
fileBaseName := utils.GetFileNameWithoutExtension(fileName)
if utils.Int64ToString(uid) != fileBaseName {
log.WarnfWithRequestId(c, "[users.UserGetAvatarHandler] cannot get other user avatar \"uid:%s\" for user \"uid:%d\"", fileBaseName, uid)
return nil, "", errs.ErrUserIdInvalid
}
user, err := a.users.GetUserById(c, uid) user, err := a.users.GetUserById(c, uid)
if err != nil { if err != nil {
@@ -741,16 +756,6 @@ func (a *UsersApi) UserGetAvatarHandler(c *core.Context) ([]byte, string, *errs.
return nil, "", errs.ErrUserAvatarNoExists return nil, "", errs.ErrUserAvatarNoExists
} }
fileName := c.Param("fileName")
fileBaseName := utils.GetFileNameWithoutExtension(fileName)
if utils.Int64ToString(user.Uid) != fileBaseName {
log.WarnfWithRequestId(c, "[users.UserGetAvatarHandler] cannot get other user avatar \"uid:%s\" for user \"uid:%d\"", fileBaseName, user.Uid)
return nil, "", errs.ErrUserIdInvalid
}
fileExtension := utils.GetFileNameExtension(fileName)
if user.CustomAvatarType != fileExtension { if user.CustomAvatarType != fileExtension {
log.WarnfWithRequestId(c, "[users.UserGetAvatarHandler] user avatar extension is invalid \"%s\" for user \"uid:%d\"", fileExtension, user.Uid) log.WarnfWithRequestId(c, "[users.UserGetAvatarHandler] user avatar extension is invalid \"%s\" for user \"uid:%d\"", fileExtension, user.Uid)
return nil, "", errs.ErrUserAvatarNoExists return nil, "", errs.ErrUserAvatarNoExists
@@ -777,5 +782,5 @@ func (a *UsersApi) UserGetAvatarHandler(c *core.Context) ([]byte, string, *errs.
return nil, "", errs.ErrOperationFailed return nil, "", errs.ErrOperationFailed
} }
return avatarData, utils.GetImageContentType(fileExtension), nil return avatarData, contentType, nil
} }