返回提交历史
Modified
src/controllers/custom/renameAccountController.ts
+2
-2
Modified
src/services/loginService.ts
+5
-1
XFEstudio/XFESpaceNinjaServer
fix: ensure rename account can't be used to take a reserved name (#4142)
Reviewed-on: https://onlyg.it/OpenWF/SpaceNinjaServer/pulls/4142 Co-authored-by: Sainan <63328889+Sainan@users.noreply.github.com> Co-committed-by: Sainan <63328889+Sainan@users.noreply.github.com>
db3e99b4
代码差异
2 个文件
+7
-3
@@ -1,5 +1,5 @@
1
1
import type { RequestHandler } from "express";
2
import { getAccountForRequest, isAdministrator, isNameTaken } from "../../services/loginService.ts";
2
import { getAccountForRequest, isAdministrator, isNameReserved, isNameTaken } from "../../services/loginService.ts";
3
3
import { config } from "../../services/configService.ts";
4
4
import { saveConfig } from "../../services/configWriterService.ts";
5
5
import { MAX_NAME_LENGTH } from "../../models/loginModel.ts";
@@ -9,7 +9,7 @@ export const renameAccountController: RequestHandler = async (req, res) => {
9
9
if (typeof req.query.newname == "string") {
10
10
if (req.query.newname.length > MAX_NAME_LENGTH) {
11
11
res.status(400).send("Name too long").end();
12
} else if (await isNameTaken(req.query.newname)) {
12
} else if ((await isNameTaken(req.query.newname)) || isNameReserved(req.query.newname)) {
13
13
res.status(409).send("Name already in use").end();
14
14
} else {
15
15
if (isAdministrator(account)) {
@@ -29,6 +29,10 @@ export const isNameTaken = async (name: string): Promise<boolean> => {
29
29
return !!(await Account.findOne({ DisplayName: name }));
30
30
};
31
31
32
export const isNameReserved = (name: string): boolean => {
33
return name == "all";
34
};
35
32
36
export const createNonce = (): number => {
33
37
return Math.round(Math.random() * Number.MAX_SAFE_INTEGER);
34
38
};
@@ -47,7 +51,7 @@ export const getUsernameFromEmail = async (email: string): Promise<string> => {
47
51
};
48
52
49
53
export const createAccount = async (accountData: IAccountCreationData): Promise<IDatabaseAccountJson> => {
50
if (accountData.DisplayName == "all") {
54
if (isNameReserved(accountData.DisplayName)) {
51
55
throw new Error(`"${accountData.DisplayName}" is reserved and may not be used as a username`);
52
56
}
53
57