TASK22017: phase 8 hardening for sensitive hash-guarded APIs

pages/api/file/deleteblobcase.js

@@ -10,25 +10,30 @@ ApiProxy.use(middleware);
 ApiProxy.get(async (req, res) => {
     var containerName = req.query.container;
     var casefolderID = req.query.casefolderID;
-    var blobName = req.query.blobname;
     var checkHash = req.query.hash;
 
+    if (
+        typeof containerName === "undefined" ||
+        containerName.length === 0 ||
+        typeof casefolderID === "undefined" ||
+        casefolderID.length === 0
+    ) {
+        return res.status(400).json();
+    }
+
     var checkquerypath =
         "/api/file/deleteblobcase?container=" +
         containerName +
         "&casefolderID=" +
         casefolderID;
 
-    //console.log(hashAPIPath(checkquerypath), checkHash);
-    //console.log(hashAPIPath(checkquerypath) == "&hash=" + checkHash);
-
-    //if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
-    await deleteBlobCase(containerName, casefolderID).then((data) => {
-        return res.status(200).json({ data: data });
-    });
-    // } else {
-    //     return res.status(400).json();
-    // }
+    if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
+        await deleteBlobCase(containerName, casefolderID).then((data) => {
+            return res.status(200).json({ data: data });
+        });
+    } else {
+        return res.status(400).json();
+    }
 });
 
 export const config = {