This commit is contained in:
1 parent
e6d7f2280b
commit
8efd032cc6
71 files changed
+6796
-3751
No files matched your search
@@ -50,7 +50,9 @@ export async function buyBadge(formData: FormData): Promise<void> {
|
||||
|
||||
// The form posts the badge row id; everything else (price, code) is resolved
|
||||
// server-side from trusted data — never from the client.
|
||||
const rawId = String(formData.get("id") ?? "").normalize("NFC").trim();
|
||||
const rawId = String(formData.get("id") ?? "")
|
||||
.normalize("NFC")
|
||||
.trim();
|
||||
if (!/^\d+$/.test(rawId)) redirect("/draw-badge?error=invalid");
|
||||
|
||||
let outcome: "bought" | "invalid" | "credits" | "fail";
|
||||
|
||||
Reference in new issue
Block a user