SunRed/haste-server
1
0
Fork 0
mirror of https://github.com/SunRed/haste-server.git synced 2024-11-23 09:50:17 +01:00
Code Issues Releases Activity

Patched POST API bug

Browse source 
It is no longer possible to make a POST request with no body content and make a "ghost key" - which upon requesting returns 404, but it considered as a taken key
This commit is contained in:
zneix 2020-09-02 16:18:47 +02:00
parent 7de68695fe
commit 04e1f09fed
WARNING! Although there is a key with this ID in the database it does not verify this commit! This commit is SUSPICIOUS.
GPG key ID: 911916E0523B22F6
1 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
lib/document_handler.js
View file

@ -80,6 +80,12 @@ DocumentHandler.prototype.handlePost = function (req, res){
let onSuccess = async function (){ let onSuccess = async function (){
//check length //check length
if (!buffer.length){
cancelled = true;
winston.warn('document with no length was POSTed');
res.status(411).json({ message: 'Length required.' });
return;
}
if (_this.maxLength && buffer.length > _this.maxLength){ if (_this.maxLength && buffer.length > _this.maxLength){
cancelled = true; cancelled = true;
winston.warn('document >maxLength', { maxLength: _this.maxLength }); winston.warn('document >maxLength', { maxLength: _this.maxLength });