- catalogo avanti, parte 1

src/server/router/index_router.js

@@ -25,6 +25,8 @@ const { CfgServer } = require('../models/cfgserver');
 const formidable = require('formidable');
 const folder = path.join(__dirname, 'upload');
 
+const sanitizeHtml = require('sanitize-html');
+
 if (!fs.existsSync(folder)) {
   fs.mkdirSync(folder);
 }
@@ -655,8 +657,11 @@ router.post('/setsubrec', authenticate, (req, res) => {
 });
 
 router.post('/gettable', authenticate, (req, res) => {
-  const params = req.body;
-  let idapp = req.user ? req.user.idapp : params.idapp;
+  let params = req.body;
+
+  params.table = sanitizeHtml(params.table);
+  
+  let idapp = req.user ? req.user.idapp : sanitizeHtml(params.idapp);
   const mytable = globalTables.getTableByTableName(params.table);
   //console.log('mytable', mytable);
   if (!mytable) {