openhands
e5ae51bff7
All user-supplied string values from FormData now go through
String.prototype.normalize('NFC') to prevent Unicode homoglyph
attacks and canonicalization bypasses. NFC is idempotent for
already-normalized strings, so this is a pure security improvement
with zero behavioral change for legitimate users.
42 lines
1.1 KiB
TypeScript
42 lines
1.1 KiB
TypeScript
"use server";
|
|
|
|
import { z } from "zod";
|
|
import { revalidatePath } from "next/cache";
|
|
import { prisma } from "@/lib/prisma";
|
|
import { rcon } from "@/lib/services/rcon";
|
|
import { authAction, actionOk } from "@/lib/foundation/action";
|
|
import { DatabaseError } from "@/lib/foundation/errors";
|
|
|
|
const MOTTO_MAX = 127;
|
|
|
|
const mottoSchema = z.object({
|
|
motto: z.string().max(MOTTO_MAX, `Motto must be at most ${MOTTO_MAX} characters`),
|
|
});
|
|
|
|
const updateMottoAction = authAction(
|
|
{ schema: mottoSchema },
|
|
async (ctx) => {
|
|
try {
|
|
await prisma.user.update({ where: { id: ctx.session.user.id }, data: { motto: ctx.data.motto } });
|
|
} catch {
|
|
throw new DatabaseError("Failed to update motto");
|
|
}
|
|
|
|
try {
|
|
await rcon.setMotto(ctx.session.user.id, ctx.data.motto);
|
|
} catch {
|
|
// RCON is best-effort; the change is already persisted.
|
|
}
|
|
|
|
revalidatePath("/settings");
|
|
return actionOk();
|
|
},
|
|
);
|
|
|
|
export async function updateMotto(formData: FormData): Promise<void> {
|
|
const motto = String(formData.get("motto") ?? "").normalize("NFC").slice(0, MOTTO_MAX);
|
|
await updateMottoAction({ motto });
|
|
}
|
|
|
|
export { updateMottoAction };
|