From 0544a0ef129d930c063a404994f89aa294d9d27f Mon Sep 17 00:00:00 2001 From: Andrew Li Date: Mon, 26 Jun 2023 14:03:02 -0400 Subject: [PATCH] Only include reportCreationData if nonempty to prevent WAF violation --- src/libs/actions/Policy.js | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/src/libs/actions/Policy.js b/src/libs/actions/Policy.js index 0bd6b45172d9..bb76ad0742c2 100644 --- a/src/libs/actions/Policy.js +++ b/src/libs/actions/Policy.js @@ -400,18 +400,17 @@ function addMembersToWorkspace(invitedEmailsToAccountIDs, welcomeNote, policyID, ]; const logins = _.map(_.keys(invitedEmailsToAccountIDs), (memberLogin) => OptionsListUtils.addSMSDomainIfPhoneNumber(memberLogin)); - API.write( - 'AddMembersToWorkspace', - { - employees: JSON.stringify(_.map(logins, (login) => ({email: login}))), + const params = { + employees: JSON.stringify(_.map(logins, (login) => ({email: login}))), - // Escape HTML special chars to enable them to appear in the invite email - welcomeNote: _.escape(welcomeNote), - policyID, - reportCreationData: JSON.stringify(membersChats.reportCreationData), - }, - {optimisticData, successData, failureData}, - ); + // Escape HTML special chars to enable them to appear in the invite email + welcomeNote: _.escape(welcomeNote), + policyID, + }; + if (!_.isEmpty(membersChats.reportCreationData)) { + params.reportCreationData = JSON.stringify(membersChats.reportCreationData); + } + API.write('AddMembersToWorkspace', params, {optimisticData, successData, failureData}); } /**