public_git
/
wireguard-ui
mirror of https://github.com/ngoduykhanh/wireguard-ui.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Return 400 instead of panicking on malformed JSON request bodies

This commit is contained in:
Ioannis Dressos 2026-07-08 12:14:13 +03:00
parent 1db5983ed5
commit d9fdd3a017
No known key found for this signature in database
1 changed files with 52 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

65
handler/routes.go
View File

@ -76,9 +76,18 @@ func Login(db store.IStore) echo.HandlerFunc {
return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false, "Bad post data"})
}
username := data["username"].(string)
password := data["password"].(string)
rememberMe := data["rememberMe"].(bool)
username, ok := data["username"].(string)
if !ok {
return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false, "Bad post data"})
}
password, ok := data["password"].(string)
if !ok {
return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false, "Bad post data"})
}
rememberMe, ok := data["rememberMe"].(bool)
if !ok {
return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false, "Bad post data"})
}
if !usernameRegexp.MatchString(username) {
return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false, "Please provide a valid username"})
@ -220,10 +229,22 @@ func UpdateUser(db store.IStore) echo.HandlerFunc {
return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false, "Bad post data"})
}
username := data["username"].(string)
password := data["password"].(string)
previousUsername := data["previous_username"].(string)
admin := data["admin"].(bool)
username, ok := data["username"].(string)
if !ok {
return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false, "Bad post data"})
}
password, ok := data["password"].(string)
if !ok {
return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false, "Bad post data"})
}
previousUsername, ok := data["previous_username"].(string)
if !ok {
return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false, "Bad post data"})
}
admin, ok := data["admin"].(bool)
if !ok {
return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false, "Bad post data"})
}
if !isAdmin(c) && (previousUsername != currentUser(c)) {
return c.JSON(http.StatusForbidden, jsonHTTPResponse{false, "Manager cannot access other user data"})
@ -294,9 +315,18 @@ func CreateUser(db store.IStore) echo.HandlerFunc {
}
var user model.User
username := data["username"].(string)
password := data["password"].(string)
admin := data["admin"].(bool)
username, ok := data["username"].(string)
if !ok {
return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false, "Bad post data"})
}
password, ok := data["password"].(string)
if !ok {
return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false, "Bad post data"})
}
admin, ok := data["admin"].(bool)
if !ok {
return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false, "Bad post data"})
}
if username == "" || !usernameRegexp.MatchString(username) {
return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false, "Please provide a valid username"})
@ -338,7 +368,10 @@ func RemoveUser(db store.IStore) echo.HandlerFunc {
return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false, "Bad post data"})
}
username := data["username"].(string)
username, ok := data["username"].(string)
if !ok {
return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false, "Bad post data"})
}
if !usernameRegexp.MatchString(username) {
return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false, "Please provide a valid username"})
@ -753,8 +786,14 @@ func SetClientStatus(db store.IStore) echo.HandlerFunc {
return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false, "Bad post data"})
}
clientID := data["id"].(string)
status := data["status"].(bool)
clientID, ok := data["id"].(string)
if !ok {
return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false, "Bad post data"})
}
status, ok := data["status"].(bool)
if !ok {
return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false, "Bad post data"})
}
if _, err := xid.FromString(clientID); err != nil {
return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false, "Please provide a valid client ID"})