X-Git-Url: https://git.auder.net/?a=blobdiff_plain;f=server%2Froutes%2Fgames.js;h=423258564b7b8b19fe5ecf5a529c8b4325a40a7f;hb=99b7a14c6e01c53a49459c8d4681acf6abe635d8;hp=c6e25a6ad79fa504b208ec4bfb67e1226a01c320;hpb=dfeb96ea90e880a2557cbb5953dbb7258c912283;p=vchess.git

diff --git a/server/routes/games.js b/server/routes/games.js
index c6e25a6a..42325856 100644
--- a/server/routes/games.js
+++ b/server/routes/games.js
@@ -1,16 +1,16 @@
-var router = require("express").Router();
-var UserModel = require("../models/User");
-var ChallengeModel = require('../models/Challenge');
-var GameModel = require('../models/Game');
-var VariantModel = require('../models/Variant');
-var access = require("../utils/access");
-var params = require("../config/parameters");
+let router = require("express").Router();
+const UserModel = require("../models/User");
+const ChallengeModel = require('../models/Challenge');
+const GameModel = require('../models/Game');
+const VariantModel = require('../models/Variant');
+const access = require("../utils/access");
+const params = require("../config/parameters");
 
 // From main hall, start game between players 0 and 1
 router.post("/games", access.logged, access.ajax, (req,res) => {
   const gameInfo = req.body.gameInfo;
   if (!Array.isArray(gameInfo.players) ||
-    !gameInfo.players.some(p => p.id == req.userId))
+    gameInfo.players.every(p => p.id != req.userId))
   {
     return res.json({errmsg: "Cannot start someone else's game"});
   }
@@ -43,6 +43,8 @@ router.get("/games", access.ajax, (req,res) => {
   const gameId = req.query["gid"];
   if (!!gameId)
   {
+    if (!gameId.match(/^[0-9]+$/))
+      return res.json({errmsg: "Wrong game ID"});
     GameModel.getOne(gameId, (err,game) => {
       access.checkRequest(res, err, game, "Game not found", () => {
         res.json({game: game});
@@ -53,6 +55,8 @@ router.get("/games", access.ajax, (req,res) => {
   {
     // Get by (non-)user ID:
     const userId = req.query["uid"];
+    if (!userId.match(/^[0-9]+$/))
+      return res.json({errmsg: "Wrong user ID"});
     const excluded = !!req.query["excluded"];
     GameModel.getByUser(userId, excluded, (err,games) => {
       if (!!err)