From 2cc2ecb13c9d92f8c27d7fab335393c2112a6a57 Mon Sep 17 00:00:00 2001
From: syuilo <syuilotan@yahoo.co.jp>
Date: Fri, 20 Jan 2017 17:51:31 +0900
Subject: [PATCH] [API] Fix: Validate id

---
 src/api/endpoints/posts/likes/create.js | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/api/endpoints/posts/likes/create.js b/src/api/endpoints/posts/likes/create.js
index d148c99d41..8963b482bf 100644
--- a/src/api/endpoints/posts/likes/create.js
+++ b/src/api/endpoints/posts/likes/create.js
@@ -28,6 +28,11 @@ module.exports = (params, user) =>
 		return rej('post_id is required');
 	}
 
+	// Validate id
+	if (!mongo.ObjectID.isValid(postId)) {
+		return rej('incorrect post_id');
+	}
+
 	// Get likee
 	const post = await Post.findOne({
 		_id: new mongo.ObjectID(postId)