rainbownapkin/canopy
1
0
Fork 0
Code Issues 5 Pull requests Projects Releases Packages Wiki Activity Actions

Updated vague DB query which could lead to pwned accounts

Browse source
This commit is contained in:
rainbow napkin 2025-11-06 19:01:22 -05:00
parent d7c55fe3da
commit be01417cdf
3 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/controllers/api/account/deleteController.js
View file

@ -38,7 +38,7 @@ module.exports.post = async function(req, res){
return res.send('Invalid Session! Cannot delete account while logged out!');
}
const userDB = await userModel.findOne(user);
const userDB = await userModel.findOne({user: user.user});
if(!userDB){

2
src/controllers/api/account/updateController.js
View file

@ -46,7 +46,7 @@ module.exports.post = async function(req, res){
const {field, change} = data;
const {user} = req.session;
const userDB = await userModel.findOne(user);
const userDB = await userModel.findOne({user: user.user});
const update = {};