From 564aa706bc9b40176a48b94c42e08e470557446d Mon Sep 17 00:00:00 2001
From: syuilo <syuilotan@yahoo.co.jp>
Date: Wed, 18 Jan 2017 05:26:29 +0900
Subject: [PATCH] [API] Fix: Validate ids

---
 src/api/endpoints/following/create.js | 5 +++++
 src/api/endpoints/following/delete.js | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/src/api/endpoints/following/create.js b/src/api/endpoints/following/create.js
index 90a6da9838..4a796b11a4 100644
--- a/src/api/endpoints/following/create.js
+++ b/src/api/endpoints/following/create.js
@@ -28,6 +28,11 @@ module.exports = (params, user) =>
 		return rej('user_id is required');
 	}
 
+	// Validate id
+	if (!mongo.ObjectID.isValid(userId)) {
+		return rej('incorrect user_id');
+	}
+
 	// 自分自身
 	if (user._id.equals(userId)) {
 		return rej('followee is yourself');
diff --git a/src/api/endpoints/following/delete.js b/src/api/endpoints/following/delete.js
index 9bb1b082e9..2da20dea38 100644
--- a/src/api/endpoints/following/delete.js
+++ b/src/api/endpoints/following/delete.js
@@ -27,6 +27,11 @@ module.exports = (params, user) =>
 		return rej('user_id is required');
 	}
 
+	// Validate id
+	if (!mongo.ObjectID.isValid(userId)) {
+		return rej('incorrect user_id');
+	}
+
 	// Check if the followee is yourself
 	if (user._id.equals(userId)) {
 		return rej('followee is yourself');