New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

When session expires, user has access to locations where update_by=undefined in YourUploads #32

Open

glenpierce opened this issue Jul 6, 2017 · 1 comment

Labels

Owner

glenpierce commented Jul 6, 2017

No description provided.

glenpierce added bug Critical labels

Collaborator

av2335 commented Nov 8, 2017

Is it because of this (line 18 from yourUploads.js)?

query = 'CALL getAllUploadsByUser("' + req.session.user + '")';

I couldn't find where getAllUploadsByUser() lives, but if req.session.user is empty, then this query would be: CALL getAllUploadsByUser("");

Is there a problem with the validation inside that function? Or, should we validate it from the outside? I.e., if(rq.session.user){query = //....

Also, does "undefined" mean "null"? If so, is there any reason we shouldn't add a Not Null constraint to update_by in the table?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment