CraftAttack/website
4
0
Fork 0
Code Issues 3 Pull Requests Actions Wiki Activity

add optional env variable to protect the public report creation endpoint with a secret
All checks were successful
delpoy / build-and-deploy (push) Successful in 45s
Details

Browse Source
This commit is contained in:
bytedream
2023-09-30 01:10:50 +02:00
parent 3713c7eaba
commit b7177708a7
3 changed files with 15 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
src/routes/report/+server.ts
View File

@ -1,9 +1,12 @@
import type { RequestHandler } from '@sveltejs/kit';
import { Report, User } from '$lib/server/database';
import * as crypto from 'crypto';
import { env } from '$env/dynamic/public';
import { env } from '$env/dynamic/private';
export const POST = (async ({ request, url }) => {
if (env.REPORT_SECRET && url.searchParams.get('secret') !== env.REPORT_SECRET)
return new Response(null, { status: 401 });
const data: { reporter: string; reported: string; reason: string } = await request.json();
if (data.reporter == null || data.reported == null || data.reason == null)