Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2026-02-28 01:21:13 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: check if folder exists when uploading files in acp

Browse Source
This commit is contained in:
Barış Soner Uşaklı
2025-03-10 16:49:40 -04:00
parent 6d74ee2f59
commit 76896859fa
2 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/controllers/admin/uploads.js
View File

@@ -244,6 +244,9 @@ uploadsController.uploadFile = async function (req, res, next) {
return next(new Error('[[error:invalid-json]]')); return next(new Error('[[error:invalid-json]]'));
} }
if (!await file.exists(path.join(nconf.get('upload_path'), params.folder))) {
return next(new Error('[[error:invalid-path]]'));
}
try { try {
const data = await file.saveFileToLocal(uploadedFile.name, params.folder, uploadedFile.path); const data = await file.saveFileToLocal(uploadedFile.name, params.folder, uploadedFile.path);
res.json([{ url: data.url }]); res.json([{ url: data.url }]);

11
test/uploads.js
View File

@@ -400,6 +400,17 @@ describe('Upload Controllers', () => {
assert.strictEqual(body.error, '[[error:invalid-path]]'); assert.strictEqual(body.error, '[[error:invalid-path]]');
}); });
it('should fail to upload regular file if directory does not exist', async () => {
const { response, body } = await helpers.uploadFile(`${nconf.get('url')}/api/admin/upload/file`, path.join(__dirname, '../test/files/test.png'), {
params: JSON.stringify({
folder: 'does-not-exist',
}),
}, jar, csrf_token);
assert.equal(response.statusCode, 500);
assert.strictEqual(body.error, '[[error:invalid-path]]');
});
describe('ACP uploads screen', () => { describe('ACP uploads screen', () => {
it('should create a folder', async () => { it('should create a folder', async () => {
const { response } = await helpers.createFolder('', 'myfolder', jar, csrf_token); const { response } = await helpers.createFolder('', 'myfolder', jar, csrf_token);