Закрыта дыра безопасности

2020-02-11 13:02:43 +07:00
parent 2484568b21
commit 1bcd902817
4 changed files with 12 additions and 5 deletions
--- a/server/controllers/MiscController.js
+++ b/server/controllers/MiscController.js
@@ -3,8 +3,11 @@ const _ = require('lodash');

 class MiscController extends BaseController {
    async getConfig(req, res) {
-        if (Array.isArray(req.body.params))
-            return _.pick(this.config, req.body.params);
+        if (Array.isArray(req.body.params)) {
+            const paramsSet = new Set(req.body.params);
+
+            return _.pick(this.config, this.config.webConfigParams.filter(x => paramsSet.has(x)));
+        }
        //bad request
        res.status(400).send({error: 'params is not an array'});
        return false;