h

files/routes/comments.py

@@ -267,6 +267,10 @@ def api_comment(v):
 						try:
 							marsey = loads(body.lower())
 							name = marsey["name"]
+
+							if not marsey_regex.fullmatch(name):
+								return {"error": "Invalid name!"}, 403
+
 							if "author" in marsey: author_id = get_user(marsey["author"]).id
 							elif "author_id" in marsey: author_id = marsey["author_id"]
 							else: abort(400)