Prevent propagation and editing of 'json_data' field in character data (#4690)

133ad15a83a0b8c3ad5362281fb9cce4f207bf5c

Cohee <18619528+Cohee1207@users.noreply.github.com>

Signed

src/endpoints/characters.js+15 -0 Viewed

         return char;
+    }
 +    // If 'json_data' was already saved, don't let it propagate
 +    _.unset(char, 'json_data');
++
     const fieldMappings = {
         name: 'name',
         description: 'description',

     // This is supposed to save all the foreign keys that ST doesn't care about
     const char = tryParse(data.json_data) || {};
 +    // Prevent erroneous 'json_data' recursive saving
 +    _.unset(char, 'json_data');
++
     // Checks if data.alternate_greetings is an array, a string, or neither, and acts accordingly. (expected to be an array of strings)
     const getAlternateGreetings = data => {
         if (Array.isArray(data.alternate_greetings)) return data.alternate_greetings;

         return response.status(400).send('Error: invalid name.');
+    }
 +    if (request.body.field === 'json_data') {
 +        console.warn('Error: cannot edit json_data field.');
 +        return response.status(400).send('Error: cannot edit json_data field.');
 +    }
++
     try {
         const avatarPath = path.join(request.user.directories.characters, request.body.avatar_url);
         const charJSON = await readCharacterData(avatarPath);

+        }
         let character = JSON.parse(pngStringData);
++
 +        _.unset(update, 'json_data');
 +        _.unset(character, 'json_data');
++
         character = deepMerge(character, update);
         const validator = new TavernCardValidator(character);