kamp/anything-llm
1
0
Fork 0
mirror of https://github.com/Mintplex-Labs/anything-llm.git synced 2024-07-02 15:20:37 +02:00
Code Issues Packages Projects Releases Wiki Activity

[BUG] Fixed mass_assignment vuln (#566)

Browse Source 
Fixed mass_assignment vuln

Co-authored-by: dastaj <78434825+dastaj@users.noreply.github.com>
This commit is contained in:
Timothy Carambat 2024-01-10 08:42:03 -08:00 committed by GitHub
parent 259079ac58
commit 8cd3a92c66
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
server/endpoints/invite.js
View File

@ -33,7 +33,7 @@ function inviteEndpoints(app) {
app.post("/invite/:code", async (request, response) => {
try {
const { code } = request.params;
const userParams = reqBody(request);
const { username, password } = reqBody(request);
const invite = await Invite.get({ code });
if (!invite || invite.status !== "pending") {
response
@ -42,7 +42,11 @@ function inviteEndpoints(app) {
return;
}
const { user, error } = await User.create(userParams);
const { user, error } = await User.create(({
username,
password,
role: "default",
}));
if (!user) {
console.error("Accepting invite:", error);
response