dont allow invalid status to be set

11 years ago · 4eabf41a21
parent bedadd8b5f
commit 4eabf41a21
1 changed files with 5 additions and 0 deletions
--- a/src/socket.io/user.js
+++ b/src/socket.io/user.js
@ -350,6 +350,11 @@ SocketUser.setStatus = function(socket, status, callback) {
 	if (!socket.uid) {
 		return callback(new Error('[[invalid-uid]]'));
 	}
+
+	var allowedStatus = ['online', 'offline', 'dnd', 'away'];
+	if (allowedStatus.indexOf(status) === -1) {
+		return callback(new Error('[[invalid-user-status]]'));
+	}
 	user.setUserField(socket.uid, 'status', status, function(err) {
 		if (err) {
 			return callback(err);