check share_to param

haiwen · Aug 23, 2023 · 58f7263 · 58f7263
1 parent 5f36ce4
commit 58f7263
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/seahub/api2/endpoints/repo_folder_share_info.py b/seahub/api2/endpoints/repo_folder_share_info.py
@@ -45,6 +45,11 @@ def get(self, request, format=None):
             error_msg = 'repo_id invalid.'
             return api_error(status.HTTP_400_BAD_REQUEST, error_msg)
 
+        share_to = request.GET.get('share_to')
+        if share_to and share_to not in ('user', 'group'):
+            error_msg = 'share_to invalid.'
+            return api_error(status.HTTP_400_BAD_REQUEST, error_msg)
+
         # resource check
         repo = seafile_api.get_repo(repo_id)
         if not repo:
@@ -58,8 +63,6 @@ def get(self, request, format=None):
 
         # get share inifo
         share_info_list = []
-        share_to = request.GET.get('share_to')
-
         try:
             seafile_db = SeafileDB()
         except Exception as e: