[API] Fix: Validate file_id

2017-02-12 06:01:31 +09:00 · 2017-02-12 06:01:31 +09:00 · 40f05f4ea5
parent 27c4d4b83b
commit 40f05f4ea5
1 changed files with 5 additions and 0 deletions
--- a/src/api/endpoints/drive/files/update.js
+++ b/src/api/endpoints/drive/files/update.js
@ -26,6 +26,11 @@ module.exports = (params, user) =>
 		return rej('file_id is required');
 	}

+	// Validate id
+	if (!mongo.ObjectID.isValid(fileId)) {
+		return rej('incorrect file_id');
+	}
+
 	const file = await DriveFile
 		.findOne({
 			_id: new mongo.ObjectID(fileId),