forks/amnezia-wg-easy
1
0
Fork 0
forked from mirrors/amnezia-wg-easy
Code Pull requests Activity

fixup: Prototype-polluting assignment (medium)

Browse source
This commit is contained in:
Philip H. 2023-12-03 10:04:42 +00:00 • committed by GitHub
parent c73e64c9c4
commit 206033a731
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/lib/Server.js
View file

@ -118,6 +118,9 @@ module.exports = class Server {
const svg = await WireGuard.getClientQRCodeSVG({ clientId }); const svg = await WireGuard.getClientQRCodeSVG({ clientId });
res.header('Content-Type', 'image/svg+xml'); res.header('Content-Type', 'image/svg+xml');
res.send(svg); res.send(svg);
if (clientId === '__proto__' || clientId === 'constructor' || clientId === 'prototype') {
res.end(403);
}
})) }))
.get('/api/wireguard/client/:clientId/configuration', Util.promisify(async (req, res) => { .get('/api/wireguard/client/:clientId/configuration', Util.promisify(async (req, res) => {
const { clientId } = req.params; const { clientId } = req.params;
@ -131,6 +134,9 @@ module.exports = class Server {
res.header('Content-Disposition', `attachment; filename="${configName || clientId}.conf"`); res.header('Content-Disposition', `attachment; filename="${configName || clientId}.conf"`);
res.header('Content-Type', 'text/plain'); res.header('Content-Type', 'text/plain');
res.send(config); res.send(config);
if (clientId === '__proto__' || clientId === 'constructor' || clientId === 'prototype') {
res.end(403);
}
})) }))
.post('/api/wireguard/client', Util.promisify(async (req) => { .post('/api/wireguard/client', Util.promisify(async (req) => {
const { name } = req.body; const { name } = req.body;