race condition security patch

2025-04-18 12:59:17 +02:00
parent 29b8a0352e
commit d8f7a862f6
53 changed files with 240 additions and 222 deletions
--- a/web/src/routes/auth/confirm-verification/[token]/+page.server.ts
+++ b/web/src/routes/auth/confirm-verification/[token]/+page.server.ts
@@ -1,4 +1,3 @@
-import { pb } from "$lib/pocketbase";
 import { Collection } from "$lib/util/api_util";
 import { error, type ServerLoad } from "@sveltejs/kit";
 import { ClientResponseError } from "pocketbase";
@@ -9,7 +8,7 @@ export const load: ServerLoad = async ({ params, locals, url, fetch }) => {
    }

    try {
-        await pb.collection(Collection.users).confirmVerification(params.token)
+        await locals.pb.collection(Collection.users).confirmVerification(params.token)
    } catch (e) {
        if (e instanceof ClientResponseError) {
            error(400, e.message);