X-Git-Url: https://git.auder.net/?p=vchess.git;a=blobdiff_plain;f=server%2Froutes%2Fusers.js;h=ebc77cced3abd1b87e49028c2b9bf0ad8a5b7997;hp=abe987cd2e3909d63b43d3553d5ad63ce27751e8;hb=fcbc92c26e382e425d3d4cc4910eaf1a1d61c989;hpb=99b7a14c6e01c53a49459c8d4681acf6abe635d8

diff --git a/server/routes/users.js b/server/routes/users.js
index abe987cd..ebc77cce 100644
--- a/server/routes/users.js
+++ b/server/routes/users.js
@@ -33,7 +33,7 @@ router.get("/whoami", access.ajax, (req,res) => {
 // NOTE: this method is safe because only IDs and names are returned
 router.get("/users", access.ajax, (req,res) => {
   const ids = req.query["ids"];
-  if (!ids.match(/^([0-9]+,?)+$/)) //NOTE: slightly too permissive
+  if (!!ids && !ids.match(/^([0-9]+,?)+$/)) //NOTE: slightly too permissive
     return res.json({errmsg: "Bad IDs array"});
   UserModel.getByIds(ids, (err,users) => {
     if (!!err)