Reject query-by-delete API requests with no query. Ref #2122.

knadh · knadh · commit ac5e10158a06 · 2024-11-05T00:18:22.000+05:30
diff --git a/cmd/subscribers.go b/cmd/subscribers.go
@@ -439,6 +439,10 @@ func handleDeleteSubscribersByQuery(c echo.Context) error {
 		return err
 	}
 
+	if req.Query == "" {
+		return echo.NewHTTPError(http.StatusBadRequest, app.i18n.Ts("globals.messages.invalidFields", "name", "query"))
+	}
+
 	if err := app.core.DeleteSubscribersByQuery(req.Query, req.ListIDs, req.SubscriptionStatus); err != nil {
 		return err
 	}

Original file line number	Diff line number	Diff line change
`@@ -439,6 +439,10 @@ func handleDeleteSubscribersByQuery(c echo.Context) error {`
`439`	`439`	`return err`
`440`	`440`	`}`
`441`	`441`
	`442`	`+ if req.Query == "" {`
	`443`	`+ return echo.NewHTTPError(http.StatusBadRequest, app.i18n.Ts("globals.messages.invalidFields", "name", "query"))`
	`444`	`+ }`
	`445`	`+`
`442`	`446`	`if err := app.core.DeleteSubscribersByQuery(req.Query, req.ListIDs, req.SubscriptionStatus); err != nil {`
`443`	`447`	`return err`
`444`	`448`	`}`