sij/anything-llm
1
0
Fork 0
mirror of https://github.com/Mintplex-Labs/anything-llm.git synced 2025-05-02 09:03:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

[BUG] Fixed mass_assignment vuln ()

Browse source 
Fixed mass_assignment vuln

Co-authored-by: dastaj <78434825+dastaj@users.noreply.github.com>
This commit is contained in:
Timothy Carambat 2024-01-10 08:42:03 -08:00 • committed by GitHub
parent 259079ac58
commit 8cd3a92c66
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 2 deletions

8
server/endpoints/invite.js
View file

@ -33,7 +33,7 @@ function inviteEndpoints(app) {
app.post("/invite/:code", async (request, response) => {
try {
const { code } = request.params;
const userParams = reqBody(request);
const { username, password } = reqBody(request);
const invite = await Invite.get({ code });
if (!invite || invite.status !== "pending") {
response
@ -42,7 +42,11 @@ function inviteEndpoints(app) {
return;
}
const { user, error } = await User.create(userParams);
const { user, error } = await User.create(({
username,
password,
role: "default",
}));
if (!user) {
console.error("Accepting invite:", error);
response