Update index.js

Author: DefenderK

routes/index.js

@@ -101,6 +101,43 @@ exports.loginHandler = function (req, res, next) {
 };
 */
 
+// Add new vulnerable code
+/*
+
+exports.loginHandler = function (req, res, next) {
+  if (validator.isEmail(req.body.username)) {
+    User.find({ username: req.body.username, password: req.body.password }, function (err, users) {
+      if (users.length > 0) {
+        const redirectPage = req.body.redirectPage
+        const session = req.session
+        const username = req.body.username
+        return adminLoginSuccess(redirectPage, session, username, res)
+      } else {
+        return res.status(401).send()
+      }
+    });
+  } else {
+    return res.status(401).send()
+  }
+};
+
+
+if (validator.isEmail(req.body.username)) {
+  User.find({ username: req.body.username, password: req.body.password }, function (err, users) {
+    if (users.length > 0) {
+      const redirectPage = req.body.redirectPage
+      const session = req.session
+      const username = req.body.username
+      return adminLoginSuccess(redirectPage, session, username, res)
+    } else {
+      return res.status(401).send()
+    }
+  });
+} else {
+  return res.status(401).send()
+};
+*/
+
 function adminLoginSuccess(redirectPage, session, username, res) {
   session.loggedIn = 1