fix(herowars): replace Object.assign with explicit field whitelists

Mass assignment via Object.assign(entity, req.body) allowed callers to overwrite protected fields (id, author). Updates are now restricted to explicitly listed data fields on both Clan and Member.
2026-04-26 20:42:29 +02:00
parent 98847b31e7
commit f293d35455
2 changed files with 8 additions and 2 deletions
@@ -98,7 +98,10 @@ module.exports.updateClan = asyncHandler(async (req, res, next) => {
        if (req.payload.id !== clan.author.id) {
            return next(new ErrorResponse("Unauthorized", 401, "Authentication required."));
        }
-        Object.assign(clan, req.body.clan);
+        const UPDATABLE_FIELDS = ['country', 'description', 'disbanding', 'frameId', 'flag', 'level', 'membersCount', 'minLevel', 'ownerId', 'serverId', 'title', 'topActivity', 'topDungeon'];
+        UPDATABLE_FIELDS.forEach(field => {
+            if (typeof req.body.clan[field] !== 'undefined') clan[field] = req.body.clan[field];
+        });
        let data = await ClanService.updateClan(clan);
        res.status(200).json({
            message: 'Clan updated successfully.',