Almost finished problems logic. TODO: showProblem() part

[vchess.git] / routes / all.js

diff --git a/routes/all.js b/routes/all.js
index f3e184e..b1e0fda 100644 (file)
--- a/routes/all.js
+++ b/routes/all.js
@@ -28,6 +28,7 @@ router.get("/:vname([a-zA-Z0-9]+)", (req,res,next) => {
                                return next(err);
                        if (!variant || variant.length==0)
                                return next(createError(404));
+                       // TODO (later...) get only n=100(?) most recent problems
                        db.all("SELECT * FROM Problems WHERE variant='" + vname + "'",
                                (err2,problems) => {
                                        if (!!err2)
@@ -55,6 +56,9 @@ router.get("/problems/:variant([a-zA-Z0-9]+)", (req,res) => {
        if (!req.xhr)
                return res.json({errmsg: "Unauthorized access"});
        // TODO: next or previous: in params + timedate (of current oldest or newest)
+       db.serialize(function() {
+               //TODO
+       });
 });
 
 // Upload a problem (AJAX)
@@ -62,10 +66,13 @@ router.post("/problems/:variant([a-zA-Z0-9]+)", (req,res) => {
        if (!req.xhr)
                return res.json({errmsg: "Unauthorized access"});
        const vname = req.params["variant"];
-       
-       // TODO: get parameters and sanitize them
-       sanitizeHtml(req.body["fen"]); // [/a-z0-9 ]*
-       sanitizeHtml(req.body["instructions"]);
+       const timestamp = Date.now();
+       // Sanitize them
+       const fen = req.body["fen"];
+       if (!fen.match(/^[a-zA-Z0-9 /]*$/))
+               return res.json({errmsg: "Bad characters in FEN string"});
+       const instructions = sanitizeHtml(req.body["instructions"]);
+       const solution = sanitizeHtml(req.body["solution"]);
        db.serialize(function() {
                let stmt = db.prepare("INSERT INTO Problems VALUES (?,?,?,?,?)");
                stmt.run(timestamp, vname, fen, instructions, solution);
@@ -74,5 +81,4 @@ router.post("/problems/:variant([a-zA-Z0-9]+)", (req,res) => {
   res.json({});
 });
 
-
 module.exports = router;