From 9258ce592c1994fa1cbeda7d0d1c686f2eff9548 Mon Sep 17 00:00:00 2001 From: Suriya Date: Tue, 21 Jul 2026 16:40:47 +0530 Subject: [PATCH] Validate password length on the user-update endpoint PUT /users/update doubles as the password-setup/reset call (userid + password only) for the new frontend create-password flow, and had no validation on that field at all. Co-Authored-By: Claude Sonnet 5 --- controllers/userController.go | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/controllers/userController.go b/controllers/userController.go index 57d048b..9150272 100644 --- a/controllers/userController.go +++ b/controllers/userController.go @@ -3,6 +3,7 @@ package controllers import ( "net/http" "strconv" + "strings" "nearle/models" "nearle/services" @@ -141,6 +142,17 @@ func (ctl *UserController) UpdateStaff(c *fiber.Ctx) error { }) } + // This endpoint also doubles as the password-setup/reset call (userid + + // password only, everything else left zero so GORM's Updates skips it) — + // guard the one field that has no validation anywhere else on this path. + if pw := strings.TrimSpace(user.Password); pw != "" && len(pw) < 6 { + return c.Status(http.StatusBadRequest).JSON(fiber.Map{ + "status": false, + "code": http.StatusBadRequest, + "message": "Password must be at least 6 characters", + }) + } + if err := ctl.userService.UpdateStaff(user); err != nil { return c.JSON(fiber.Map{ "status": false,