Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-11-10 07:55:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: closes #13475, don't store escaped username

Browse Source 
when updating profile
This commit is contained in:
Barış Soner Uşaklı
2025-06-05 11:42:29 -04:00
parent 4fbcfae8b1
commit 806e54bf5a
2 changed files with 28 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/api/users.js
View File

@@ -57,7 +57,7 @@ usersAPI.update = async function (caller, data) {
throw new Error('[[error:invalid-data]]');
}
const oldUserData = await user.getUserFields(data.uid, ['email', 'username']);
const oldUserData = await db.getObjectFields(`user:${data.uid}`, ['email', 'username']);
if (!oldUserData || !oldUserData.username) {
throw new Error('[[error:invalid-data]]');
}
@@ -86,14 +86,14 @@ usersAPI.update = async function (caller, data) {
await user.updateProfile(caller.uid, data);
const userData = await user.getUserData(data.uid);
if (userData.username !== oldUserData.username) {
const oldUsernameEscaped = validator.escape(String(oldUserData.username));
if (userData.username !== oldUsernameEscaped) {
await events.log({
type: 'username-change',
uid: caller.uid,
targetUid: data.uid,
ip: caller.ip,
oldUsername: oldUserData.username,
oldUsername: oldUsernameEscaped,
newUsername: userData.username,
});
}