Put filtering before the check of auth as auth uses data from the body that has to be sanitized first.
MODIFY
src/server/rest/v1/service/RegistrationTokenService.ts
src/server/rest/v1/service/RegistrationTokenService.ts
@@ -81,8 +81,11 @@ export default class RegistrationTokenService {
}
static async handleUpdateRegistrationToken(action: ServerAction, req: Request, res: Response, next: NextFunction): Promise<void> {
+ // Filter
+ const filteredRequest = RegistrationTokenSecurity.filterRegistrationTokenUpdateRequest(req.body);
+ UtilsService.assertIdIsProvided(action, filteredRequest.id, MODULE_NAME, 'handleUpdateRegistrationToken', req.user);
// Check Auth
- if (!Authorizations.canUpdateRegistrationToken(req.user, req.body.siteAreaID)) {
+ if (!Authorizations.canUpdateRegistrationToken(req.user, filteredRequest.siteAreaID)) {
// Not Authorized!
throw new AppAuthError({
errorCode: HTTPAuthError.ERROR,
@@ -91,9 +94,6 @@ export default class RegistrationTokenService {
module: MODULE_NAME, method: 'handleUpdateRegistrationToken'
});
}
- // Filter
- const filteredRequest = RegistrationTokenSecurity.filterRegistrationTokenUpdateRequest(req.body);
- UtilsService.assertIdIsProvided(action, filteredRequest.id, MODULE_NAME, 'handleUpdateRegistrationToken', req.user);
// Get Token
const registrationToken = await RegistrationTokenStorage.getRegistrationToken(req.user.tenantID, filteredRequest.id);
UtilsService.assertObjectExists(action, registrationToken, `Token ID '${filteredRequest.id}' does not exist`,

Put filtering before the check of auth as auth uses data from the body that has to be sanitized first.