fix: check input for user model

controller/github.go

@@ -105,7 +105,14 @@ func GitHubOAuth(c *gin.Context) {
 		GitHubId: githubUser.Login,
 	}
 	if model.IsGitHubIdAlreadyTaken(user.GitHubId) {
-		user.FillUserByGitHubId()
+		err := user.FillUserByGitHubId()
+		if err != nil {
+			c.JSON(http.StatusOK, gin.H{
+				"success": false,
+				"message": err.Error(),
+			})
+			return
+		}
 	} else {
 		if common.RegisterEnabled {
 			user.Username = "github_" + strconv.Itoa(model.GetMaxUserId()+1)
@@ -171,7 +178,14 @@ func GitHubBind(c *gin.Context) {
 	id := session.Get("id")
 	// id := c.GetInt("id")  // critical bug!
 	user.Id = id.(int)
-	user.FillUserById()
+	err = user.FillUserById()
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
 	user.GitHubId = githubUser.Login
 	err = user.Update(false)
 	if err != nil {

controller/message.go

@@ -44,7 +44,14 @@ func PostPushMessage(c *gin.Context) {
 
 func pushMessageHelper(c *gin.Context, message *channel.Message) {
 	user := model.User{Username: c.Param("username")}
-	user.FillUserByUsername()
+	err := user.FillUserByUsername()
+	if err != nil {
+		c.JSON(http.StatusForbidden, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
 	if user.Status == common.UserStatusNonExisted {
 		c.JSON(http.StatusForbidden, gin.H{
 			"success": false,
@@ -87,7 +94,7 @@ func pushMessageHelper(c *gin.Context, message *channel.Message) {
 			message.Channel = channel.TypeEmail
 		}
 	}
-	err := message.Send(&user)
+	err = message.Send(&user)
 	if err != nil {
 		c.JSON(http.StatusOK, gin.H{
 			"success": false,

controller/user.go

@@ -478,9 +478,16 @@ func DeleteUser(c *gin.Context) {
 func DeleteSelf(c *gin.Context) {
 	id := c.GetInt("id")
 	user := model.User{Id: id}
-	user.FillUserById()
+	err := user.FillUserById()
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
 	channel.TokenStoreRemoveUser(&user)
-	err := model.DeleteUserById(id)
+	err = model.DeleteUserById(id)
 	if err != nil {
 		c.JSON(http.StatusOK, gin.H{
 			"success": false,
@@ -633,10 +640,17 @@ func EmailBind(c *gin.Context) {
 	user := model.User{
 		Id: id,
 	}
-	user.FillUserById()
+	err := user.FillUserById()
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
 	user.Email = email
 	// no need to check if this email already taken, because we have used verification code to check it
-	err := user.Update(false)
+	err = user.Update(false)
 	if err != nil {
 		c.JSON(http.StatusOK, gin.H{
 			"success": false,

controller/wechat.go

@@ -70,7 +70,14 @@ func WeChatAuth(c *gin.Context) {
 		WeChatId: wechatId,
 	}
 	if model.IsWeChatIdAlreadyTaken(wechatId) {
-		user.FillUserByWeChatId()
+		err := user.FillUserByWeChatId()
+		if err != nil {
+			c.JSON(http.StatusOK, gin.H{
+				"success": false,
+				"message": err.Error(),
+			})
+			return
+		}
 	} else {
 		if common.RegisterEnabled {
 			user.Username = "wechat_" + strconv.Itoa(model.GetMaxUserId()+1)
@@ -132,7 +139,14 @@ func WeChatBind(c *gin.Context) {
 	user := model.User{
 		Id: id,
 	}
-	user.FillUserById()
+	err = user.FillUserById()
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"success": false,
+			"message": err.Error(),
+		})
+		return
+	}
 	user.WeChatId = wechatId
 	err = user.Update(false)
 	if err != nil {