popertots/Crussell
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(auth): lowercase referral code before validation and lookup

Browse Source 
Defense-in-depth: referral codes are generated as hex (lowercase only) by the DB. The frontend already lowercases on input, but direct API calls with uppercase would fail the DB lookup. Normalize to lowercase on the backend to prevent capslock situations.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
This commit is contained in:
popertots
2026-06-04 12:02:39 +01:00
co-authored by Sisyphus
parent 486173c5ff
commit 7d1b90a5be
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/handlers/auth/local.go
+1 -1
View File
@@ -177,7 +177,7 @@ func RegisterHandler(w http.ResponseWriter, r *http.Request) {
// Validate referral code if provided // Validate referral code if provided
var referrerID *string var referrerID *string
req.ReferralCode = strings.TrimSpace(req.ReferralCode) req.ReferralCode = strings.ToLower(strings.TrimSpace(req.ReferralCode))
if req.ReferralCode != "" { if req.ReferralCode != "" {
if len(req.ReferralCode) != 12 { if len(req.ReferralCode) != 12 {
http.Error(w, "referral code must be exactly 12 characters", http.StatusBadRequest) http.Error(w, "referral code must be exactly 12 characters", http.StatusBadRequest)