Escape potentially dangerous input in the search field
This commit is contained in:
@@ -201,7 +201,7 @@ router.post("/submit_edit_post", (req,res) => {
|
||||
}); // /submit_edit
|
||||
|
||||
router.get('/search', (req, res) => {
|
||||
const search_term = req.query.q; // 'q' is the parameter name
|
||||
const search_term = func.escape_input(req.query.q); // 'q' is the parameter name
|
||||
let search_type = req.query.type; // eg 'post', 'user'
|
||||
if (typeof search_type == 'string') { // Make the search_term an array
|
||||
search_type = [ search_type ]
|
||||
|
Reference in New Issue
Block a user