From 06940e8998335a903753ff641db1b81da172c70c Mon Sep 17 00:00:00 2001
From: Luke Berndt <lukekb@gmail.com>
Date: Sat, 15 Jul 2023 13:08:56 -0400
Subject: [PATCH] fixed regex

---
 account/server/config/passport-strategies/local.js |  9 +++++++--
 account/server/controllers/users.js                | 13 ++++++++-----
 admin/server/config/passport-strategies/local.js   |  8 ++++++--
 3 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/account/server/config/passport-strategies/local.js b/account/server/config/passport-strategies/local.js
index cdff5ad..8e3d98d 100644
--- a/account/server/config/passport-strategies/local.js
+++ b/account/server/config/passport-strategies/local.js
@@ -12,12 +12,17 @@ If your site prefers to name these fields differently, options are available to
 const local = new LocalStrategy({
 	usernameField: "email"
 }, async (email, password, done) => {
+
+	// https://stackoverflow.com/questions/3446170/escape-string-for-use-in-javascript-regex/6969486#6969486
+	const escapeRegExp = (string) => {
+		return string.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); // $& means the whole matched string
+	}
 	const user = await User.findOne({
 		$or: [{
-			email: { '$regex': email, $options: 'i' } 
+			email: { '$regex': escapeRegExp(email), $options: 'i' } 
 		}, {
 			local: {
-				email: { '$regex': email, $options: 'i' } 
+				email: { '$regex': escapeRegExp(email), $options: 'i' } 
 			}
 		}]
 	});
diff --git a/account/server/controllers/users.js b/account/server/controllers/users.js
index d60fa10..ebfe7a8 100644
--- a/account/server/controllers/users.js
+++ b/account/server/controllers/users.js
@@ -15,7 +15,10 @@ const mailjet = new Mailjet({
   apiSecret: process.env['MAILJET_SECRET']
 });
 
-
+	// https://stackoverflow.com/questions/3446170/escape-string-for-use-in-javascript-regex/6969486#6969486
+	const escapeRegExp = (string) => {
+		return string.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); // $& means the whole matched string
+	}
 
 exports.isLoggedIn = function (req, res, next) {
   if (req.isAuthenticated()) return next();
@@ -268,7 +271,7 @@ exports.resetPassword = async function (req, res, next) {
 // -------------------------------------------
 exports.sendResetPassword = async function (req, res, next) {
   let user = await User.findOne({
-    email: { '$regex': req.body.email, $options: 'i' } 
+    email: { '$regex': escapeRegExp(req.body.email), $options: 'i' } 
   }).catch(err => {
     console.error(err);
     res.status(500);
@@ -552,7 +555,7 @@ exports.updateProfile = async function (req, res, next) {
 
   // Lets make sure someone else isn't using this screenName
 
-  screenNameUser = await User.findOne({ screenName:  { '$regex': req.body.screenName , $options: 'i' }  }).catch(err => {
+  screenNameUser = await User.findOne({ screenName:  { '$regex': escapeRegExp(req.body.screenName) , $options: 'i' }  }).catch(err => {
     console.error(err);
     res.status(500);
     res.json({
@@ -616,10 +619,10 @@ exports.register = async function (req, res, next) {
 
   let user = await User.findOne({
     $or: [{
-			email: { '$regex': req.body.email, $options: 'i' } 
+			email: { '$regex': escapeRegExp(req.body.email), $options: 'i' } 
 		}, {
 			local: {
-				email: { '$regex': req.body.email, $options: 'i' } 
+				email: { '$regex': escapeRegExp(req.body.email), $options: 'i' } 
 			}
 		}]
   }).catch(err => {
diff --git a/admin/server/config/passport-strategies/local.js b/admin/server/config/passport-strategies/local.js
index b909e8a..a2c80a5 100644
--- a/admin/server/config/passport-strategies/local.js
+++ b/admin/server/config/passport-strategies/local.js
@@ -14,12 +14,16 @@ const User = require("../../models/user");
  module.exports = new LocalStrategy({
  	usernameField: "email"
  }, (email, password, done) => {
+	// https://stackoverflow.com/questions/3446170/escape-string-for-use-in-javascript-regex/6969486#6969486
+	const escapeRegExp = (string) => {
+		return string.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); // $& means the whole matched string
+	}
  	User.findOne({
     $or: [{
-		email: { '$regex': email, $options: 'i' } 
+		email: { '$regex': escapeRegExp(email), $options: 'i' } 
     }, {
       local: {
-        email: { '$regex': email, $options: 'i' } 
+        email: { '$regex': escapeRegExp(email), $options: 'i' } 
       }
     }]
   }, (err, user) => {