fix: Validate uuid on attachments.create endpoint

2022-08-20 23:46:01 +02:00
parent f32f07cdcc
commit 72b0e78788
1 changed files with 2 additions and 1 deletions
--- a/server/routes/api/attachments.ts
+++ b/server/routes/api/attachments.ts
@@ -56,7 +56,8 @@ router.post("attachments.create", auth(), async (ctx) => {
  const endpoint = publicS3Endpoint();
  const url = `${endpoint}/${key}`;

-  if (documentId) {
+  if (documentId !== undefined) {
+    assertUuid(documentId, "documentId must be a uuid");
    const document = await Document.findByPk(documentId, {
      userId: user.id,
    });