Sea-Studio/MC_Report
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: prevent username/email enumeration via registration error messages

Browse Source
This commit is contained in:
canglan
2026-07-13 18:29:32 +08:00
parent b24f8cd74d
commit befd51dbd5
2 changed files with 4 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
backend/routes/auth.js
View File

@@ -41,12 +41,9 @@ router.post('/register', validateLengths({
} }
const existingUser = await getRow('SELECT id FROM users WHERE username = ?', [username]); const existingUser = await getRow('SELECT id FROM users WHERE username = ?', [username]);
if (existingUser) {
return res.status(400).json({ error: '用户名已存在' });
}
const existingEmail = await getRow('SELECT id FROM users WHERE email = ?', [email]); const existingEmail = await getRow('SELECT id FROM users WHERE email = ?', [email]);
if (existingEmail) { if (existingUser || existingEmail) {
return res.status(400).json({ error: '邮箱已被注册' }); return res.status(400).json({ error: '用户名或邮箱已被使用' });
} }
const hashed = await bcrypt.hash(password, 10); const hashed = await bcrypt.hash(password, 10);

4
backend/routes/external.js
View File

@@ -24,8 +24,8 @@ router.post('/auth/register', async (req, res) => {
const { username, password, email, game_name, game_uid } = req.body; const { username, password, email, game_name, game_uid } = req.body;
if (!username || !password || !email || !game_name || !game_uid) return res.status(400).json({ error: '所有字段必填' }); if (!username || !password || !email || !game_name || !game_uid) return res.status(400).json({ error: '所有字段必填' });
if (password.length < 6) return res.status(400).json({ error: '密码至少6位' }); if (password.length < 6) return res.status(400).json({ error: '密码至少6位' });
if (await getRow('SELECT id FROM users WHERE username = ?', [username])) return res.status(400).json({ error: '用户名已存在' }); if (await getRow('SELECT id FROM users WHERE username = ?', [username])) return res.status(400).json({ error: '注册失败，请检查输入信息' });
if (await getRow('SELECT id FROM users WHERE email = ?', [email])) return res.status(400).json({ error: '邮箱已注册' }); if (await getRow('SELECT id FROM users WHERE email = ?', [email])) return res.status(400).json({ error: '注册失败，请检查输入信息' });
const hashed = bcrypt.hashSync(password, 10); const hashed = bcrypt.hashSync(password, 10);
const verifyToken = uuid(); const verifyToken = uuid();