From d8e0eac61b57eb9eb18b713d70750458819f71c6 Mon Sep 17 00:00:00 2001
From: Ajay Ramachandran <dev@ajay.app>
Date: Sat, 28 Jan 2023 12:18:34 -0500
Subject: [PATCH] Use includes and check in sql usage

---
 src/routes/shadowBanUser.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/routes/shadowBanUser.ts b/src/routes/shadowBanUser.ts
index e0d0f40..35df540 100644
--- a/src/routes/shadowBanUser.ts
+++ b/src/routes/shadowBanUser.ts
@@ -23,7 +23,7 @@ export async function shadowBanUser(req: Request, res: Response): Promise<Respon
 
     const categories: Category[] = parseCategories(req, config.categoryList as Category[]);
 
-    if (adminUserIDInput == undefined || (userID == undefined && hashedIP == undefined || type !== "1" && type !== "2")) {
+    if (adminUserIDInput == undefined || (userID == undefined && hashedIP == undefined || !["1", "2"].includes(type))) {
         //invalid request
         return res.sendStatus(400);
     }
@@ -119,6 +119,8 @@ export async function shadowBanUser(req: Request, res: Response): Promise<Respon
 }
 
 async function unHideSubmissions(categories: string[], userID: UserID, type = "1") {
+    if (!["1", "2"].includes(type)) return;
+    
     await db.prepare("run", `UPDATE "sponsorTimes" SET "shadowHidden" = ${type} WHERE "userID" = ? AND "category" in (${categories.map((c) => `'${c}'`).join(",")})
                     AND NOT EXISTS ( SELECT "videoID", "category" FROM "lockCategories" WHERE
                     "sponsorTimes"."videoID" = "lockCategories"."videoID" AND "sponsorTimes"."service" = "lockCategories"."service" AND "sponsorTimes"."category" = "lockCategories"."category")`, [userID]);