From 5094a82704455436aeeb8dc878bfcf968f17d489 Mon Sep 17 00:00:00 2001 From: Shaun Hamilton Date: Mon, 30 Oct 2023 17:05:13 +0200 Subject: [PATCH] Merge pull request from GHSA-f69g-q6v2-rhjp * fix(api-server): only allow specified profile keys * simplify and fix validation --- api-server/src/server/boot/settings.js | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/api-server/src/server/boot/settings.js b/api-server/src/server/boot/settings.js index 6a5e199062a..c3d8699aab8 100644 --- a/api-server/src/server/boot/settings.js +++ b/api-server/src/server/boot/settings.js @@ -146,9 +146,23 @@ function updateMyProfileUI(req, res, next) { user, body: { profileUI } } = req; + + const update = { + isLocked: !!profileUI.isLocked, + showAbout: !!profileUI.showAbout, + showCerts: !!profileUI.showCerts, + showDonation: !!profileUI.showDonation, + showHeatMap: !!profileUI.showHeatMap, + showLocation: !!profileUI.showLocation, + showName: !!profileUI.showName, + showPoints: !!profileUI.showPoints, + showPortfolio: !!profileUI.showPortfolio, + showTimeLine: !!profileUI.showTimeLine + }; + user.updateAttribute( 'profileUI', - profileUI, + update, createStandardHandler(req, res, next, 'flash.privacy-updated') ); }