Fix username html injection

2026-07-20 20:53:33 +10:00
parent b4750b9053
commit fa20bf7fc4
2 changed files with 17 additions and 12 deletions
--- a/server/src/db.h
+++ b/server/src/db.h
@@ -9,13 +9,18 @@

 #include "post.h"

+void sanitize(std::string& str);
+
 struct User {
    uint64_t id = 0;
    std::string name = "";
    std::string passwordHash = "";

-    User(uint64_t id, const std::string& name, const std::string& passwordHash) :
-        id(id), name(name), passwordHash(passwordHash) {}
+    User(uint64_t id, std::string namein, const std::string& passwordHash) :
+        id(id), passwordHash(passwordHash) {
+            sanitize(namein);
+            name = namein;
+        }
 };

 class Database {