Merge pull request #4365 from AccaliaDeElementia/master

Fixes #4364

src/socket.io/notifications.js

@@ -3,6 +3,7 @@
 var async = require('async');
 var user = require('../user');
 var notifications = require('../notifications');
+var utils = require('../../public/src/utils');
 
 var SocketNotifs = {};
 
@@ -15,7 +16,7 @@ SocketNotifs.get = function(socket, data, callback) {
 };
 
 SocketNotifs.loadMore = function(socket, data, callback) {
-	if (!data || !parseInt(data.after, 10)) {
+	if (!data || !utils.isNumber(data.after) || parseInt(data.after, 10) < 0) {
 		return callback(new Error('[[error:invalid-data]]'));
 	}
 	if (!socket.uid) {

src/socket.io/topics/infinitescroll.js

@@ -88,7 +88,7 @@ module.exports = function(SocketTopics) {
 	};
 
 	SocketTopics.loadMoreUnreadTopics = function(socket, data, callback) {
-		if (!data || !data.after) {
+		if (!data || !utils.isNumber(data.after) || parseInt(data.after, 10) < 0) {
 			return callback(new Error('[[error:invalid-data]]'));
 		}
 
@@ -99,7 +99,7 @@ module.exports = function(SocketTopics) {
 	};
 
 	SocketTopics.loadMoreFromSet = function(socket, data, callback) {
-		if (!data || !data.after || !data.set) {
+		if (!data || !utils.isNumber(data.after) || parseInt(data.after, 10) < 0 || !data.set) {
 			return callback(new Error('[[error:invalid-data]]'));
 		}