properly quote and escape query to member service

Author: maxceem

connect/service.js

@@ -166,7 +166,7 @@ const getUsersById = (ids) => {
  * @return {Promise}   resolves to the list of user details
  */
 const getUsersByHandle = (handles) => {
-  const query = _.map(handles, (handle) => 'handle:' + handle).join(' OR ');
+  const query = _.map(handles, (handle) => 'handle:"' + handle.trim().replace('"', '\\"') + '"').join(' OR ');
   return M2m.getMachineToken(config.AUTH0_CLIENT_ID, config.AUTH0_CLIENT_SECRET)
     .catch((err) => {
       err.message = 'Error generating m2m token: ' + err.message;

src/common/tcApiHelper.js

@@ -83,7 +83,7 @@ function* getUsersByHandles(handles) {
     return [];
   }
   // use 'OR' to link the handle matches
-  const query = _.map(handles, (h) => 'handle:"' + h.trim() + '"').join(' OR ');
+  const query = _.map(handles, (h) => 'handle:"' + h.trim().replace('"', '\\"')  + '"').join(' OR ');
   return yield searchUsersByQuery(query);
 }