nfp
/
storage-upload
1
0
Fork 0
Code Issues Pull Requests Projects Releases 13 Wiki Activity

routes: Fix path joining when removing files and traverse detection
continuous-integration/appveyor/branch AppVeyor build succeeded Details

master v2.2.6
Jonatan Nilsson 2022-08-16 08:36:08 +00:00
parent b931dfb784
commit 75929e7c17
2 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
api/media/routes.mjs
View File

@ -199,7 +199,7 @@ export default class MediaRoutes {
this.filesCacheRemove(site, ctx.params.filename)
let root = `${config.get('uploadFolder')}/${site}`
let root = path.join(config.get('uploadFolder'), site)
var unlinkPath = path.join(root, decodeURIComponent(ctx.params.filename))
if (unlinkPath.indexOf(root) !== 0) {

3
test/media/routes.test.mjs
View File

@ -1,4 +1,5 @@
import fs from 'fs/promises'
import path from 'path'
import { Eltro as t, assert, stub } from 'eltro'
import { HttpError } from 'flaska'
import { createContext } from '../helper.server.mjs'
@ -936,7 +937,7 @@ t.describe('#remove()', function() {
assert.match(err.message, new RegExp(assertFilename))
assert.match(err.message, new RegExp(assertErrorMessage))
assert.strictEqual(stubUnlink.firstCall[0], `./public/${assertSiteName}/${assertFilename}`)
assert.strictEqual(stubUnlink.firstCall[0], path.join(`./public/${assertSiteName}/`, assertFilename))
})
t.test('should otherwise return 204 status and remove from array', async function() {