Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
app.post('/reg', csrf, checkNotLogin, function(req,res){
if (!config.allowReg) {
res.redirect('/');
return req.flash(res.__("REG_NOT_ALLOWED"));
}
var name = req.body.username,
mail = req.body.email,
password = req.body.password,
repeatPassword = req.body['password-repeat'];
try {
check(name, 'USERNAME_EMPTY').notEmpty();
check(name, 'USERNAME_ALPHANUMERIC').isAlphanumeric();
check(password, 'PASSWORD_EMPTY').notEmpty();
check(repeatPassword, 'PASSWORD_NOT_EQUAL').equals(password);
check(mail, 'EMAIL_INVALID').len(4, 64).isEmail();
} catch (e) {
req.flash('error', res.__(e.message));
return res.redirect('/reg');
}
// get password hash
var hash = crypto.createHash('sha256'),
password = hash.update(req.body.password).digest('hex');
var newUser = new User({
name: name,
password: password,
email: mail,
activekey: hat(),
role: 'inactive'
function validateStatus(status){
check(status.user).notEmpty();
check(status.status).notEmpty();
}
nv(122.2).isFloat()
nv('123').isInt()
nv('aa').notEmpty()
nv(new Date()).isDate()
nv('abc').isAlpha()
nv('abc').isLowercase()
nv('ABC').isUppercase()
nv('ABC').isIn('ABCDEFG')
nv('123').isIn('123456789')
nv('ABC').isIn(['ABCDEFG','123','234','ABC'])
nv('234').isIn(['ABCDEFG','123','234','abc'])
nv('sfsd@fsfas.com').isEmail()
nv('http://bbs.csdn.net/topics/270080323/').isUrl()
nv('10.10.10.10').isIP()
}
func: function(value, baton, callback) {
try {
check(value).isUrl();
} catch (e) {
callback(e.message);
return;
}
callback(null, value);
},
help: 'URL'
func: function(value, baton, callback) {
try {
check(value).notNull();
} catch (e) {
callback(e.message);
return;
}
callback(null, value);
},
help: 'Non-null value'
function validateConfig(widgetConfig) {
check(widgetConfig.version, localize.translate("EXCEPTION_INVALID_VERSION"))
.notNull()
.regex("^[0-9]{1,3}([.][0-9]{1,3}){2,3}$");
check(widgetConfig.name, localize.translate("EXCEPTION_INVALID_NAME")).notEmpty();
check(widgetConfig.author, localize.translate("EXCEPTION_INVALID_AUTHOR")).notNull();
check(widgetConfig.id, localize.translate("EXCEPTION_INVALID_ID")).regex("^[a-zA-Z][a-zA-Z0-9 ]*[a-zA-Z0-9]$");
check(widgetConfig.content, localize.translate("EXCEPTION_INVALID_CONTENT"))
.notNull()
.notEmpty();
validateSplashScreensIcon(widgetConfig, "rim:splash");
validateSplashScreensIcon(widgetConfig, "icon");
if (widgetConfig.accessList) {
widgetConfig.accessList.forEach(function (access) {
if (access.uri) {
if (access.uri !== "WIDGET_LOCAL") {
check(access.uri, localize.translate("EXCEPTION_INVALID_ACCESS_URI_NO_PROTOCOL", access.uri))
func: function(value, baton, callback) {
var ip;
try {
check(value).isIP();
ip = normalizeIP(value);
} catch (e) {
callback(e.message);
return;
}
callback(null, ip);
},
help: 'IPv4 or IPv6 address'
function validateInvitation(invitation){
check(invitation.inviter).isNull();
check(invitation.invitees).isNull().isArray();
check(invitation.replyList).isNull().isArray();
check(invitation.description).isNull();
check(invitation.createDate).isNull().isDate();
check(invitation.startDate).isNull().isDate();
}
exports.insertion = function (req, res, next) {
debugCtrller("/controllers/stockOut/insertion");
if (!req.session || !req.session.user) {
return res.redirect("/login");
}
var stockOutInfo = {};
try {
check(req.body.giftId).notEmpty();
check(req.body.num).notEmpty();
check(req.body.amount).notEmpty();
check(req.body.applyUserId).notEmpty();
check(req.body.underDept).notEmpty();
check(req.body.ptId).notEmpty();
stockOutInfo.giftId = sanitize(sanitize(req.body.giftId).trim()).xss();
stockOutInfo.num = sanitize(sanitize(req.body.num).trim()).xss();
stockOutInfo.amount = sanitize(sanitize(req.body.amount).trim()).xss();
stockOutInfo.applyUserId = sanitize(sanitize(req.body.applyUserId).trim()).xss();
stockOutInfo.underDept = sanitize(sanitize(req.body.underDept).trim()).xss();
stockOutInfo.ptId = sanitize(sanitize(req.body.ptId).trim()).xss();
stockOutInfo.remark = sanitize(sanitize(req.body.remark).trim()).xss();
stockOutInfo.other = sanitize(sanitize(req.body.other).trim()).xss();
} catch (e) {
return res.send(resUtil.generateRes(null, config.statusCode.STATUS_INVAILD_PARAMS));
}
function validateConfig(widgetConfig) {
check(widgetConfig.version, localize.translate("EXCEPTION_INVALID_VERSION"))
.notNull()
.regex("^[0-9]{1,3}([.][0-9]{1,3}){2,3}$");
for (var prop in widgetConfig.name) {
if (widgetConfig.name.hasOwnProperty(prop)) {
check(widgetConfig.name[prop], localize.translate("EXCEPTION_INVALID_NAME")).notEmpty();
}
}
check(widgetConfig.author, localize.translate("EXCEPTION_INVALID_AUTHOR")).notNull();
check(widgetConfig.content, localize.translate("EXCEPTION_INVALID_CONTENT"))
.notNull()
.notEmpty();
validateSplashScreensIcon(widgetConfig, "rim:splash");
validateSplashScreensIcon(widgetConfig, "icon");
if (widgetConfig.accessList) {
widgetConfig.accessList.forEach(function (access) {
if (access.uri) {
if (access.uri !== "WIDGET_LOCAL") {
check(access.uri, localize.translate("EXCEPTION_INVALID_ACCESS_URI_NO_PROTOCOL", access.uri))
.regex("^[a-zA-Z]+:\/\/");
check(access.uri, localize.translate("EXCEPTION_INVALID_ACCESS_URI_NO_URN", access.uri))
.notRegex("^[a-zA-Z]+:\/\/$");