fix xss on banning domains (only admins could use it)

2022-12-27 07:18:46 +02:00 · 2022-12-27 07:18:46 +02:00 · 512c864327
parent 465565f26c
commit 512c864327
1 changed files with 5 additions and 0 deletions
--- a/files/routes/admin.py
+++ b/files/routes/admin.py
@ -1518,6 +1518,11 @@ def ban_domain(v):
 	reason=request.values.get("reason", "").strip()
 	if not reason: abort(400, 'Reason is required!')

+	if len(reason) > 100:
+		abort(400, 'Reason is too long (max 100 characters)!')
+
+	reason = filter_emojis_only(reason)
+
 	if len(reason) > 100:
 		abort(400, 'Reason is too long (max 100 characters)!')