mongodb 注入漏洞

cnodejs · May 5, 2015 · 0f6cc14 · 0f6cc14 · JacksonTian · May 6, 2015
1 parent b7ac06b
commit 0f6cc14
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/controllers/sign.js b/controllers/sign.js
@@ -171,8 +171,8 @@ exports.signout = function (req, res, next) {
 };
 
 exports.active_account = function (req, res, next) {
-  var key = req.query.key;
-  var name = req.query.name;
+  var key = validator.trim(req.query.key);
+  var name = validator.trim(req.query.name);
 
   User.getUserByLoginName(name, function (err, user) {
     if (err) {
@@ -238,8 +238,8 @@ exports.updateSearchPass = function (req, res, next) {
  * @param  {Function} next
  */
 exports.reset_pass = function (req, res, next) {
-  var key = req.query.key;
-  var name = req.query.name;
+  var key = validator.trim(req.query.key);
+  var name = validator.trim(req.query.name);
   User.getUserByNameAndKey(name, key, function (err, user) {
     if (!user) {
       res.status(403);