From 35512bef8d1906982a28dc8e0b9d30750b0fa929 Mon Sep 17 00:00:00 2001
From: nymkappa <vialjoris@hotmail.com>
Date: Tue, 23 Aug 2022 22:47:18 +0200
Subject: [PATCH 1/2] Do not fetch node stats for channel tree graph

---
 backend/src/api/explorer/channels.api.ts | 45 ++++++++++++++++--------
 1 file changed, 30 insertions(+), 15 deletions(-)

diff --git a/backend/src/api/explorer/channels.api.ts b/backend/src/api/explorer/channels.api.ts
index a0a617e43..b5eac7499 100644
--- a/backend/src/api/explorer/channels.api.ts
+++ b/backend/src/api/explorer/channels.api.ts
@@ -288,21 +288,36 @@ class ChannelsApi {
 
       const channels: any[] = []
       for (const row of allChannels) {
-        const activeChannelsStats: any = await nodesApi.$getActiveChannelsStats(row.public_key);
-        channels.push({
-          status: row.status,
-          closing_reason: row.closing_reason,
-          capacity: row.capacity ?? 0,
-          short_id: row.short_id,
-          id: row.id,
-          fee_rate: row.node1_fee_rate ?? row.node2_fee_rate ?? 0,
-          node: {
-            alias: row.alias.length > 0 ? row.alias : row.public_key.slice(0, 20),
-            public_key: row.public_key,
-            channels: activeChannelsStats.active_channel_count ?? 0,
-            capacity: activeChannelsStats.capacity ?? 0,
-          }
-        });
+        let channel;
+        if (index >= 0) {
+          const activeChannelsStats: any = await nodesApi.$getActiveChannelsStats(row.public_key);
+          channel = {
+            status: row.status,
+            closing_reason: row.closing_reason,
+            capacity: row.capacity ?? 0,
+            short_id: row.short_id,
+            id: row.id,
+            fee_rate: row.node1_fee_rate ?? row.node2_fee_rate ?? 0,
+            node: {
+              alias: row.alias.length > 0 ? row.alias : row.public_key.slice(0, 20),
+              public_key: row.public_key,
+              channels: activeChannelsStats.active_channel_count ?? 0,
+              capacity: activeChannelsStats.capacity ?? 0,
+            }
+          };
+        } else if (index === -1) {
+          channel = {
+            capacity: row.capacity ?? 0,
+            short_id: row.short_id,
+            id: row.id,
+            node: {
+              alias: row.alias.length > 0 ? row.alias : row.public_key.slice(0, 20),
+              public_key: row.public_key,
+            }
+          };
+        }
+
+        channels.push(channel);
       }
 
       return channels;

From 43cc9499b1dbfdd18ca0c12a1e4e07aa2e9462ef Mon Sep 17 00:00:00 2001
From: nymkappa <vialjoris@hotmail.com>
Date: Wed, 24 Aug 2022 08:35:02 +0200
Subject: [PATCH 2/2] Check query input before running the mysql query

---
 backend/src/api/explorer/channels.routes.ts | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/backend/src/api/explorer/channels.routes.ts b/backend/src/api/explorer/channels.routes.ts
index 0fa91db92..eda3a6168 100644
--- a/backend/src/api/explorer/channels.routes.ts
+++ b/backend/src/api/explorer/channels.routes.ts
@@ -47,8 +47,17 @@ class ChannelsRoutes {
         res.status(400).send('Missing parameter: public_key');
         return;
       }
+
       const index = parseInt(typeof req.query.index === 'string' ? req.query.index : '0', 10) || 0;
       const status: string = typeof req.query.status === 'string' ? req.query.status : '';
+
+      if (index < -1) {
+        res.status(400).send('Invalid index');
+      }
+      if (['open', 'active', 'closed'].includes(status) === false) {
+        res.status(400).send('Invalid status');
+      }
+
       const channels = await channelsApi.$getChannelsForNode(req.query.public_key, index, 10, status);
       const channelsCount = await channelsApi.$getChannelsCountForNode(req.query.public_key, status);
       res.header('Pragma', 'public');