Merge pull request #31 from owncloud/fix-30

Validation on adding user to group
owncloud · Aug 6, 2020 · 43514cd · 43514cd
2 parents 886f75d + 0db046d
commit 43514cd
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/pkg/service/v0/groups.go b/pkg/service/v0/groups.go
@@ -41,8 +41,14 @@ func (o Ocs) ListUserGroups(w http.ResponseWriter, r *http.Request) {
 
 // AddToGroup adds a user to a group
 func (o Ocs) AddToGroup(w http.ResponseWriter, r *http.Request) {
+	r.ParseForm()
 	userid := chi.URLParam(r, "userid")
-	groupid := r.URL.Query().Get("groupid")
+	groupid := r.PostForm.Get("groupid")
+
+	if groupid == "" {
+		render.Render(w, r, response.ErrRender(data.MetaBadRequest.StatusCode, "empty group assignment: unspecified group"))
+		return
+	}
 
 	_, err := o.getGroupsService().AddMember(r.Context(), &accounts.AddMemberRequest{
 		AccountId: userid,