From 60a79d20ab91c37a273a70d6c03336b8d5207fd6 Mon Sep 17 00:00:00 2001
From: Adam Soltys <asoltys@gmail.com>
Date: Sun, 27 Aug 2023 21:44:10 +0000
Subject: validate amounts

---
 routes/payments.js | 1 +
 1 file changed, 1 insertion(+)

(limited to 'routes')

diff --git a/routes/payments.js b/routes/payments.js
index 71260e11..425561f1 100644
--- a/routes/payments.js
+++ b/routes/payments.js
@@ -233,6 +233,7 @@ export default {
 
   async take({ body: { name, amount, hash }, user }, res) {
     amount = parseInt(amount);
+    if (amount < 0) fail("Invalid amount");
 
     await t(`pot:${name}`, async (balance, db) => {
       if (balance < amount) fail("Insufficient funds");
-- 
cgit v1.2.3