Add expiry on sign up draft (to prevent leakage of personal information)

[ndcode_site.git] / api / account / sign_up / create_account.json.jst

diff --git a/api/account/sign_up/create_account.json.jst b/api/account/sign_up/create_account.json.jst
index 85c4ef7..db66bb9 100644 (file)
--- a/api/account/sign_up/create_account.json.jst
+++ b/api/account/sign_up/create_account.json.jst
@@ -1,3 +1,4 @@
+let logjson = (await import('@ndcode/logjson')).default
 let XDate = require('xdate')
 
 return async env => {
@@ -36,14 +37,21 @@ return async env => {
         let session = await session_cookie(env, transaction)
 
         let captcha = await session.get('captcha')
-        if (captcha === undefined || XDate.now() >= captcha.get('expires'))
+        if (
+          captcha === undefined ||
+            XDate.now() >= await logjson.logjson_to_json(
+              await captcha.get('expires')
+            )
+        )
           throw new Problem(
             'No verification image in session',
             `Please call the "/api/verification_image.png" endpoint to create a verification image, in same session as the "/api/account/sign_up/create_account.json" call and less than one hour prior.`,
             418
           )
         
-        let captcha_text = await captcha.get('text')
+        let captcha_text = await logjson.logjson_to_json(
+          await captcha.get('text')
+        )
         if (verification_code !== captcha_text) {
           console.log(`verification code mismatch, \"${verification_code}\" should be \"${captcha_text}\"`)