Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-10-26 16:46:12 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: only allow numbers as scores (#7356)

Browse Source 
* zadd score checks

* fix: only allow numbers as scores

* fix: convert values to strings
This commit is contained in:
Barış Soner Uşaklı
2019-02-11 11:23:18 -05:00
committed by GitHub
parent 0fffcb3855
commit 5917dec288
6 changed files with 76 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/database/mongo/sorted/add.js
View File

@@ -2,6 +2,7 @@
module.exports = function (db, module) {
var helpers = module.helpers.mongo;
var utils = require('../../../utils');
module.sortedSetAdd = function (key, score, value, callback) {
callback = callback || helpers.noop;
@@ -11,7 +12,9 @@ module.exports = function (db, module) {
if (Array.isArray(score) && Array.isArray(value)) {
return sortedSetAddBulk(key, score, value, callback);
}
if (!utils.isNumber(score)) {
return setImmediate(callback, new Error('[[error:invalid-score, ' + score + ']]'));
}
value = helpers.valueToString(value);
db.collection('objects').updateOne({ _key: key, value: value }, { $set: { score: parseFloat(score) } }, { upsert: true, w: 1 }, function (err) {
@@ -29,7 +32,11 @@ module.exports = function (db, module) {
if (scores.length !== values.length) {
return callback(new Error('[[error:invalid-data]]'));
}
for (let i = 0; i < scores.length; i += 1) {
if (!utils.isNumber(scores[i])) {
return setImmediate(callback, new Error('[[error:invalid-score, ' + scores[i] + ']]'));
}
}
values = values.map(helpers.valueToString);
var bulk = db.collection('objects').initializeUnorderedBulkOp();
@@ -48,6 +55,9 @@ module.exports = function (db, module) {
if (!Array.isArray(keys) || !keys.length) {
return callback();
}
if (!utils.isNumber(score)) {
return setImmediate(callback, new Error('[[error:invalid-score, ' + score + ']]'));
}
value = helpers.valueToString(value);
var bulk = db.collection('objects').initializeUnorderedBulkOp();