diff options
| author | Omar Roth <omarroth@protonmail.com> | 2020-02-28 14:10:01 -0500 |
|---|---|---|
| committer | Omar Roth <omarroth@protonmail.com> | 2020-02-28 14:10:01 -0500 |
| commit | 697c00dccf02730ed1af2d71595af0177ac1baad (patch) | |
| tree | 01101a98ab25d9be1e416269b7666af6ef35515a | |
| parent | 1caf6a32985338cccd4f189f924d60a3d4aa6cf8 (diff) | |
| download | invidious-697c00dccf02730ed1af2d71595af0177ac1baad.tar.gz invidious-697c00dccf02730ed1af2d71595af0177ac1baad.tar.bz2 invidious-697c00dccf02730ed1af2d71595af0177ac1baad.zip | |
Sanitize PLID
| -rw-r--r-- | src/invidious.cr | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/src/invidious.cr b/src/invidious.cr index 0c80f8e0..0a10027b 100644 --- a/src/invidious.cr +++ b/src/invidious.cr @@ -428,7 +428,7 @@ get "/watch" do |env| next env.redirect "/" end - plid = env.params.query["list"]? + plid = env.params.query["list"]?.try &.gsub(/[^a-zA-Z0-9_-]/, "") continuation = process_continuation(PG_DB, env.params.query, plid, id) nojs = env.params.query["nojs"]? @@ -613,7 +613,7 @@ end get "/embed/" do |env| locale = LOCALES[env.get("preferences").as(Preferences).locale]? - if plid = env.params.query["list"]? + if plid = env.params.query["list"]?.try &.gsub(/[^a-zA-Z0-9_-]/, "") begin playlist = get_playlist(PG_DB, plid, locale: locale) offset = env.params.query["index"]?.try &.to_i? || 0 @@ -640,7 +640,7 @@ get "/embed/:id" do |env| locale = LOCALES[env.get("preferences").as(Preferences).locale]? id = env.params.url["id"] - plid = env.params.query["list"]? + plid = env.params.query["list"]?.try &.gsub(/[^a-zA-Z0-9_-]/, "") continuation = process_continuation(PG_DB, env.params.query, plid, id) if md = env.params.query["playlist"]? @@ -1264,9 +1264,9 @@ get "/playlist" do |env| locale = LOCALES[env.get("preferences").as(Preferences).locale]? user = env.get?("user").try &.as(User) - plid = env.params.query["list"]? referer = get_referer(env) + plid = env.params.query["list"]?.try &.gsub(/[^a-zA-Z0-9_-]/, "") if !plid next env.redirect "/" end |