activity feed possible SQL injection fix

citizenos · Aug 28, 2018 · 76ad607 · 76ad607
1 parent a8900d4
commit 76ad607
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/routes/api/topic.js b/routes/api/topic.js
@@ -7333,7 +7333,8 @@ module.exports = function (app) {
         });
 
         return includedSql.join(' UNION ');
-    }
+    };
+
     var activitiesList = function (req, res, next, visibility) {
         var limitMax = 50;
         var limitDefault = 10;        
@@ -7360,7 +7361,9 @@ module.exports = function (app) {
 
         var filterBy = '';
         if (filters.length) {
-            var filtersEscaped = filters.map(function (filter ) { return db.escape(filter);});
+            var filtersEscaped = filters.map(function (filter) {
+                return db.escape(filter);
+            });
             filterBy = 'WHERE uac.data#>>\'{object, @type}\' IN (' + filtersEscaped.join(',') + ')';
         }