Update controllers/user.js

spout · spout · commit a61bee0dec94 · 2012-09-17T20:55:09.000+08:00
解决头像url被注入bug
diff --git a/controllers/user.js b/controllers/user.js
@@ -115,7 +115,7 @@ exports.setting = function (req, res, next) {
     email = sanitize(email).xss();
     var url = sanitize(req.body.url).trim();      
     url = sanitize(url).xss();
-    var profile_image_url = sanitize(req.body.profile_image_url).trim();
+    var profile_image_url = sanitize(sanitize(req.body.profile_image_url).trim()).xss();
     var location = sanitize(req.body.location).trim();      
     location = sanitize(location).xss();
     var signature = sanitize(req.body.signature).trim();      
