Reject query-by-delete API requests with no query. Ref #2122.

knadh · Nov 4, 2024 · ac5e101 · ac5e101
1 parent d8a394d
commit ac5e101
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/cmd/subscribers.go b/cmd/subscribers.go
@@ -439,6 +439,10 @@ func handleDeleteSubscribersByQuery(c echo.Context) error {
 		return err
 	}
 
+	if req.Query == "" {
+		return echo.NewHTTPError(http.StatusBadRequest, app.i18n.Ts("globals.messages.invalidFields", "name", "query"))
+	}
+
 	if err := app.core.DeleteSubscribersByQuery(req.Query, req.ListIDs, req.SubscriptionStatus); err != nil {
 		return err
 	}