From dc32621a049467658320e48ffd62ee64d59a71b0 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Thu, 13 May 2021 18:32:50 -0400 Subject: validate invoice amount --- routes/invoices.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/routes/invoices.js b/routes/invoices.js index cc8549e1..f7682bfe 100644 --- a/routes/invoices.js +++ b/routes/invoices.js @@ -43,7 +43,8 @@ app.post( if (!user) throw new Error("user not provided"); if (!invoice.currency) invoice.currency = user.currency; if (!invoice.rate) invoice.rate = app.get("rates")[invoice.currency]; - if (invoice.tip > invoice.amount || invoice.tip > 1000000) throw new Error("tip is too large") + if (invoice.tip > invoice.amount || invoice.tip > 1000000) throw new Error("tip is too large"); + if (invoice.tip < 0 || invoice.amount < 0) throw new Error("invalid amount"); invoice.user_id = user.id; invoice.account_id = user.account_id; -- cgit v1.2.3