[API] Fix: Validate file_id

This commit is contained in:
syuilo 2017-02-12 06:01:31 +09:00
parent 27c4d4b83b
commit 40f05f4ea5
1 changed files with 5 additions and 0 deletions

View File

@ -26,6 +26,11 @@ module.exports = (params, user) =>
return rej('file_id is required'); return rej('file_id is required');
} }
// Validate id
if (!mongo.ObjectID.isValid(fileId)) {
return rej('incorrect file_id');
}
const file = await DriveFile const file = await DriveFile
.findOne({ .findOne({
_id: new mongo.ObjectID(fileId), _id: new mongo.ObjectID(fileId),