Update and improve the security

Author: Nitro

README.md

@@ -143,6 +143,7 @@ Request: `/comment`
 ```json
 {
     "id":"ID from mongodb, ObjectID",
+    "email":"User Email, @avonoldfarms.com",
     "pw":"String, MD5 encrypted password"
 }
 ```
@@ -151,6 +152,7 @@ Request: `/comment`
 ```json
 {
     "id":"5f59080a5923552004a899f3",
+    "email":"test1@avonoldfarms.com",
     "pw":"4a7d1ed414474e4033ac29ccb8653d9b"
 }
 ```

src/database/comment.js

@@ -31,11 +31,12 @@ async function addComment(date, name, email, pw, meal, menu, like, comment) {
     }
 }
 
-async function deleteComment(id, pw) {
+async function deleteComment(id, email, pw) {
     const db = await getDB()
     let item = await db.collection(colName).findOne(
         {
             _id: id,
+            email: email,
             pw: pw,
         }
     )

src/index.js

@@ -1,3 +1,5 @@
+// Backend Ver: v2.0.1
+
 // Importing Environmental Variables
 if (process.env.NODE_ENV !== 'production') {
   require('dotenv').config()
@@ -30,7 +32,7 @@ const {
   isComment
 } = require('./modules/valid')
 
-const debug = true
+const debug = false
 
 // Initializing App
 const app = express()
@@ -195,19 +197,31 @@ app.post('/comment', async (req, res) => {
 
 app.post('/delete_comment', async (req, res) => {
   let id = ObjectID(req.body.id) // Hexadecimal
+  let email = req.body.email
   let pw = req.body.pw // MD5
 
+  if (debug) {
+    console.log(id)
+    console.log(email)
+    console.log(pw)
+  }
+
   if (!isHexadecimal(id)) {
     callback(res, 400, 'POST Error: Invalid comment id.')
     return
   }
 
+  if (!isEmail(email)) {
+    callback(res, 400, 'POST Error: Invalid email.')
+    return
+  }
+
   if (!isMD5(pw)) {
     callback(res, 400, 'POST Error: Invalid password.')
     return
   }
 
-  const r = await deleteComment(id, pw).catch((error) => {
+  const r = await deleteComment(id, email, pw).catch((error) => {
     if (error === 403) {
       callback(res, 403, 'POST Error: Cannot find the comment to delete.')
     } else {
@@ -244,9 +258,9 @@ app.get('/comment', async (req, res) => {
 })
 
 function callback(res, code, text) {
-  if (debug) {
-    console.log(text)
-  }
+  //if (debug) {
+  console.log(text)
+  //}
   res.status(code).send({ message: text })
 }