Merge pull request #117 from HyeokjinKang/chore-1031

fix: 배너 버그 수정 및 SSRF 방어 방법 수정
HyeokjinKang · Oct 31, 2023 · 450ba8f · 450ba8f
2 parents 745fd3c + cb003cb
commit 450ba8f
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 12 deletions.
diff --git a/public/js/game.js b/public/js/game.js
@@ -1295,22 +1295,21 @@ const profileUpdate = async (uid, isMe) => {
     document.getElementsByClassName("profileStatValue")[3].textContent = profile.playtime;
     document.getElementsByClassName("profileStatValue")[4].textContent = profile["1stNum"];
     banners = JSON.parse(profile.banner);
-    if (banners.length == 0) {
-      document.getElementById("profileBanner").innerHTML = `<span class="nothingHere">${nothingHere}</span>`;
-    } else {
-      document.getElementById("profileBanner").innerHTML = `<div id="profileBannerContainer"></div>`;
-      for (let i = 0; i < banners.length; i++) {
-        if (banners[i].indexOf("(-)") != -1 && !isMe) continue;
-        document.getElementById("profileBannerContainer").innerHTML += `
+    document.getElementById("profileBanner").innerHTML = `<div id="profileBannerContainer"></div>`;
+    let count = 0;
+    for (let i = 0; i < banners.length; i++) {
+      if (banners[i].indexOf("(-)") != -1 && !isMe) continue;
+      count++;
+      document.getElementById("profileBannerContainer").innerHTML += `
         <div class="bannerImage${isMe ? " clickable" : ""}${banners[i].indexOf("(-)") != -1 ? " hidden" : ""}" style="background-image: url('${cdn}/banners/${banners[i].replace("(-)", "")}.webp')" ${
-          isMe ? `onclick="bannerToggle(${i})"` : ""
-        }>
+        isMe ? `onclick="bannerToggle(${i})"` : ""
+      }>
           <div class="bannerHover">
             <img src="/images/parts/icons/${banners[i].indexOf("(-)") != -1 ? "eye-closed" : "eye"}.svg" class="bannerIcon">
           </div>
         </div>`;
-      }
     }
+    if (count == 0) document.getElementById("profileBanner").innerHTML = `<span class="nothingHere">${nothingHere}</span>`;
     let recentPlay = JSON.parse(profile.recentPlay);
     if (recentPlay.length == 0) {
       document.getElementsByClassName("profileStatValue")[5].textContent = "-";

diff --git a/src/index.ts b/src/index.ts
@@ -122,7 +122,10 @@ const upload = multer({
 }).single("img");
 
 app.post("/profile/:userid/:type", async (req, res) => {
-  if (req.params.type != "picture" && req.params.type != "background") {
+  let type = "";
+  if (req.params.type == "picture") type = "picture";
+  else if (req.params.type == "background") type = "background";
+  else {
     res.status(400).json({
       result: "failed",
       message: "Error occured while uploading",
@@ -150,7 +153,7 @@ app.post("/profile/:userid/:type", async (req, res) => {
       });
       return;
     }
-    fetch(`${config.project.api}/profile/${req.params.type}`, {
+    fetch(`${config.project.api}/profile/${type}`, {
       method: "PUT",
       headers: {
         "Content-Type": "application/json",