Actions
Bug #33
closedService Line Field Accepts Non existing random ID Without Validation
Status:
Closed
Priority:
Normal
Assignee:
-
Description
The serviceLine field in the organization update API accepts arbitrary values (Non existinng random IDs) without proper validation or verification against existing records.
Steps to Reproduce:
- Send request to POST https://api.akinderwellness.com:4001/api/organizations/update
- Modify the serviceLine parameter:
- serviceLine = random_non_existing_id (e.g., 68c3f959d0742f0f57243221, 68c3f959d0742f0f50d0d0d3 )
- Send the request
Expected Result:
API should:
- Verify that the serviceLine exists
- Reject invalid IDs
Actual Result:
Any valid ObjectId format is accepted
No verification of existence is performed
Request succeeds
Suggested Fix:
Validate that serviceLine exists before updating
Return error if ID is invalid:Invalid serviceLine ID
Enforce strict reference validation at backend level
Actions