Title
[Bug] Strict Type Inequality Fails Ownership Check in Review Update and Delete Routes
Category / Type
Bug / Authorization & Type Coercion
Affected Files
backend/routes/reviewRoutes.js
Description
In backend/routes/reviewRoutes.js, review update and delete handlers check ownership using strict type inequality:
if (existing.user_id !== req.user.id && req.user.role !== 'admin') {
return res.status(403).json({ success: false, message: 'Unauthorized to update this review' });
}And in router.delete('/:id'):
if (existing.user_id !== req.user.id && req.user.role !== 'admin') {
return res.status(403).json({ success: false, message: 'Unauthorized to delete this review' });
}When MySQL queries return existing.user_id as a number (e.g. integer 10) while req.user.id decoded from the JWT token is a string ("10"), strict inequality !== evaluates to true. This causes legitimate users to be rejected with 403 Unauthorized to update this review.
Impact
- Severity: Medium
- Legitimate users are prevented from editing or deleting their own submitted reviews due to numeric vs string ID type mismatch.
Recommended Fix
Use string comparison String(existing.user_id) !== String(req.user.id) in both PUT /api/reviews/:id and DELETE /api/reviews/:id.
Title
[Bug] Strict Type Inequality Fails Ownership Check in Review Update and Delete Routes
Category / Type
Bug / Authorization & Type Coercion
Affected Files
backend/routes/reviewRoutes.jsDescription
In
backend/routes/reviewRoutes.js, review update and delete handlers check ownership using strict type inequality:And in
router.delete('/:id'):When MySQL queries return
existing.user_idas a number (e.g. integer10) whilereq.user.iddecoded from the JWT token is a string ("10"), strict inequality!==evaluates totrue. This causes legitimate users to be rejected with 403Unauthorized to update this review.Impact
Recommended Fix
Use string comparison
String(existing.user_id) !== String(req.user.id)in bothPUT /api/reviews/:idandDELETE /api/reviews/:id.