From 7ee929aef7414ee43d441aa9ef5d0ff685e4dbeb Mon Sep 17 00:00:00 2001 From: JustSong Date: Fri, 25 Nov 2022 16:48:20 +0800 Subject: [PATCH] fix: check input for user model --- controller/github.go | 18 +++++++++++++++-- controller/message.go | 11 +++++++++-- controller/user.go | 22 +++++++++++++++++---- controller/wechat.go | 18 +++++++++++++++-- model/user.go | 46 ++++++++++++++++++++++++++++++++++++------- 5 files changed, 98 insertions(+), 17 deletions(-) diff --git a/controller/github.go b/controller/github.go index 0a7d0b1..7fc446f 100644 --- a/controller/github.go +++ b/controller/github.go @@ -105,7 +105,14 @@ func GitHubOAuth(c *gin.Context) { GitHubId: githubUser.Login, } if model.IsGitHubIdAlreadyTaken(user.GitHubId) { - user.FillUserByGitHubId() + err := user.FillUserByGitHubId() + if err != nil { + c.JSON(http.StatusOK, gin.H{ + "success": false, + "message": err.Error(), + }) + return + } } else { if common.RegisterEnabled { user.Username = "github_" + strconv.Itoa(model.GetMaxUserId()+1) @@ -171,7 +178,14 @@ func GitHubBind(c *gin.Context) { id := session.Get("id") // id := c.GetInt("id") // critical bug! user.Id = id.(int) - user.FillUserById() + err = user.FillUserById() + if err != nil { + c.JSON(http.StatusOK, gin.H{ + "success": false, + "message": err.Error(), + }) + return + } user.GitHubId = githubUser.Login err = user.Update(false) if err != nil { diff --git a/controller/message.go b/controller/message.go index ad61c44..14f25b3 100644 --- a/controller/message.go +++ b/controller/message.go @@ -44,7 +44,14 @@ func PostPushMessage(c *gin.Context) { func pushMessageHelper(c *gin.Context, message *channel.Message) { user := model.User{Username: c.Param("username")} - user.FillUserByUsername() + err := user.FillUserByUsername() + if err != nil { + c.JSON(http.StatusForbidden, gin.H{ + "success": false, + "message": err.Error(), + }) + return + } if user.Status == common.UserStatusNonExisted { c.JSON(http.StatusForbidden, gin.H{ "success": false, @@ -87,7 +94,7 @@ func pushMessageHelper(c *gin.Context, message *channel.Message) { message.Channel = channel.TypeEmail } } - err := message.Send(&user) + err = message.Send(&user) if err != nil { c.JSON(http.StatusOK, gin.H{ "success": false, diff --git a/controller/user.go b/controller/user.go index 6d53a7a..52f9e4e 100644 --- a/controller/user.go +++ b/controller/user.go @@ -478,9 +478,16 @@ func DeleteUser(c *gin.Context) { func DeleteSelf(c *gin.Context) { id := c.GetInt("id") user := model.User{Id: id} - user.FillUserById() + err := user.FillUserById() + if err != nil { + c.JSON(http.StatusOK, gin.H{ + "success": false, + "message": err.Error(), + }) + return + } channel.TokenStoreRemoveUser(&user) - err := model.DeleteUserById(id) + err = model.DeleteUserById(id) if err != nil { c.JSON(http.StatusOK, gin.H{ "success": false, @@ -633,10 +640,17 @@ func EmailBind(c *gin.Context) { user := model.User{ Id: id, } - user.FillUserById() + err := user.FillUserById() + if err != nil { + c.JSON(http.StatusOK, gin.H{ + "success": false, + "message": err.Error(), + }) + return + } user.Email = email // no need to check if this email already taken, because we have used verification code to check it - err := user.Update(false) + err = user.Update(false) if err != nil { c.JSON(http.StatusOK, gin.H{ "success": false, diff --git a/controller/wechat.go b/controller/wechat.go index 013d213..4167b73 100644 --- a/controller/wechat.go +++ b/controller/wechat.go @@ -70,7 +70,14 @@ func WeChatAuth(c *gin.Context) { WeChatId: wechatId, } if model.IsWeChatIdAlreadyTaken(wechatId) { - user.FillUserByWeChatId() + err := user.FillUserByWeChatId() + if err != nil { + c.JSON(http.StatusOK, gin.H{ + "success": false, + "message": err.Error(), + }) + return + } } else { if common.RegisterEnabled { user.Username = "wechat_" + strconv.Itoa(model.GetMaxUserId()+1) @@ -132,7 +139,14 @@ func WeChatBind(c *gin.Context) { user := model.User{ Id: id, } - user.FillUserById() + err = user.FillUserById() + if err != nil { + c.JSON(http.StatusOK, gin.H{ + "success": false, + "message": err.Error(), + }) + return + } user.WeChatId = wechatId err = user.Update(false) if err != nil { diff --git a/model/user.go b/model/user.go index f606fcb..27a258d 100644 --- a/model/user.go +++ b/model/user.go @@ -62,6 +62,9 @@ func SearchUsers(keyword string) (users []*User, err error) { } func GetUserById(id int, selectAll bool) (*User, error) { + if id == 0 { + return nil, errors.New("id 为空！") + } user := User{Id: id} var err error = nil if selectAll { @@ -78,6 +81,9 @@ func GetUserById(id int, selectAll bool) (*User, error) { } func DeleteUserById(id int) (err error) { + if id == 0 { + return errors.New("id 为空！") + } user := User{Id: id} return user.Delete() } @@ -107,6 +113,9 @@ func (user *User) Update(updatePassword bool) error { } func (user *User) Delete() error { + if user.Id == 0 { + return errors.New("id 为空！") + } err := DB.Delete(user).Error return err } @@ -117,8 +126,8 @@ func (user *User) ValidateAndFill() (err error) { // that means if your field’s value is 0, '', false or other zero values, // it won’t be used to build query conditions password := user.Password - if password == "" { - return errors.New("密码为空") + if user.Username == "" || password == "" { + return errors.New("用户名或密码为空") } DB.Where(User{Username: user.Username}).First(user) okay := common.ValidatePasswordAndHash(password, user.Password) @@ -128,24 +137,44 @@ func (user *User) ValidateAndFill() (err error) { return nil } -func (user *User) FillUserById() { +func (user *User) FillUserById() error { + if user.Id == 0 { + return errors.New("id 为空！") + } DB.Where(User{Id: user.Id}).First(user) + return nil } -func (user *User) FillUserByEmail() { +func (user *User) FillUserByEmail() error { + if user.Email == "" { + return errors.New("email 为空！") + } DB.Where(User{Email: user.Email}).First(user) + return nil } -func (user *User) FillUserByGitHubId() { +func (user *User) FillUserByGitHubId() error { + if user.GitHubId == "" { + return errors.New("GitHub id 为空！") + } DB.Where(User{GitHubId: user.GitHubId}).First(user) + return nil } -func (user *User) FillUserByWeChatId() { +func (user *User) FillUserByWeChatId() error { + if user.WeChatId == "" { + return errors.New("WeChat id 为空！") + } DB.Where(User{WeChatId: user.WeChatId}).First(user) + return nil } -func (user *User) FillUserByUsername() { +func (user *User) FillUserByUsername() error { + if user.Username == "" { + return errors.New("username 为空！") + } DB.Where(User{Username: user.Username}).First(user) + return nil } func ValidateUserToken(token string) (user *User) { @@ -177,6 +206,9 @@ func IsUsernameAlreadyTaken(username string) bool { } func ResetUserPasswordByEmail(email string, password string) error { + if email == "" || password == "" { + return errors.New("邮箱地址或密码为空！") + } hashedPassword, err := common.Password2Hash(password) if err != nil { return err