chrisp/brackt
1
1
Fork 0
Code Issues 42 Pull requests Projects Releases Packages Wiki Activity Actions 1

fix: validate participantIds server-side instead of trusting form input

Browse source 
Fetch participants from the DB in the action using the season ID from
the URL params, eliminating the untrusted participantIds hidden field.
Remove the now-unused hidden input from the frontend form.

https://claude.ai/code/session_01WHRynBCcugSK7HHEmN6Yuy
This commit is contained in:
Claude 2026-02-19 23:40:38 +00:00
parent 5dd6d90193
commit 2c2df277d1
No known key found for this signature in database
2 changed files with 2 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
app/routes/admin.sports-seasons.$id.expected-values.server.ts
View file

@ -40,12 +40,8 @@ const scoringRules = {
export async function action({ request, params }: Route.ActionArgs) {
const formData = await request.formData();
const participantIdsRaw = formData.get("participantIds");
if (typeof participantIdsRaw !== "string" || !participantIdsRaw) {
return { error: "No participant IDs provided" };
}
const participantIds = participantIdsRaw.split(",").filter(Boolean);
const participants = await findParticipantsBySportsSeasonId(params.id);
const participantIds = participants.map((p: { id: string }) => p.id);
try {
const results = await Promise.all(

5
app/routes/admin.sports-seasons.$id.expected-values.tsx
View file

@ -30,10 +30,6 @@ export default function ExpectedValuesPage({ loaderData, actionData }: Route.Com
0
);
const participantIds = participants
.map((p: { id: string; name: string }) => p.id)
.join(",");
return (
<div className="container mx-auto p-6 space-y-6">
<div className="flex items-center gap-4">
@ -85,7 +81,6 @@ export default function ExpectedValuesPage({ loaderData, actionData }: Route.Com
</div>
<Form method="post">
<input type="hidden" name="participantIds" value={participantIds} />
<Table>
<TableHeader>