From 92fcdd09ca5485680f5d64b54848523fbfa05fa3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bar=C4=B1=C5=9F=20Soner=20U=C5=9Fakl=C4=B1?= Date: Tue, 10 Mar 2026 10:46:17 -0400 Subject: [PATCH] fix: closes #14074, only return url & name from uploads, add tests to post uploads and thumb uploads to check only name & url is returned --- src/controllers/uploads.js | 8 ++--- test/files/nodebb.svg | 1 + test/topics/thumbs.js | 3 +- test/uploads.js | 64 ++++++++++++++++++-------------------- 4 files changed, 37 insertions(+), 39 deletions(-) create mode 100644 test/files/nodebb.svg diff --git a/src/controllers/uploads.js b/src/controllers/uploads.js index fc17f44b4b..6452535977 100644 --- a/src/controllers/uploads.js +++ b/src/controllers/uploads.js @@ -75,12 +75,12 @@ async function uploadAsImage(req, uploadedFile) { let fileObj = await uploadsController.uploadFile(req.uid, uploadedFile); // sharp can't save svgs skip resize for them const isSVG = uploadedFile.type === 'image/svg+xml'; - if (isSVG || meta.config.resizeImageWidth === 0 || meta.config.resizeImageWidthThreshold === 0) { - return fileObj; + const resizeDisabled = meta.config.resizeImageWidth === 0 || meta.config.resizeImageWidthThreshold === 0; + if (!isSVG && !resizeDisabled) { + fileObj = await resizeImage({ ...fileObj, type: uploadedFile.type }); } - fileObj = await resizeImage({ ...fileObj, type: uploadedFile.type }); - return { url: fileObj.url }; + return { url: fileObj.url, name: fileObj.name }; } async function uploadAsFile(req, uploadedFile) { diff --git a/test/files/nodebb.svg b/test/files/nodebb.svg new file mode 100644 index 0000000000..27b38bd87a --- /dev/null +++ b/test/files/nodebb.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/test/topics/thumbs.js b/test/topics/thumbs.js index b740596c74..85517588a0 100644 --- a/test/topics/thumbs.js +++ b/test/topics/thumbs.js @@ -240,8 +240,9 @@ describe('Topic thumbs', () => { }); it('should succeed with a valid tid', async () => { - const { response } = await helpers.uploadFile(`${nconf.get('url')}/api/v3/topics/1/thumbs`, path.join(__dirname, '../files/test.png'), {}, adminJar, adminCSRF); + const { response, body } = await helpers.uploadFile(`${nconf.get('url')}/api/v3/topics/1/thumbs`, path.join(__dirname, '../files/test.png'), {}, adminJar, adminCSRF); assert.strictEqual(response.statusCode, 200); + assert.deepStrictEqual(Object.keys(body.response.images[0]), ['url', 'name']); }); it('should succeed with uploader plugins', async () => { diff --git a/test/uploads.js b/test/uploads.js index fdf30ed03d..1662a16e55 100644 --- a/test/uploads.js +++ b/test/uploads.js @@ -35,41 +35,23 @@ describe('Upload Controllers', () => { let regularUid; let maliciousUid; - before((done) => { - async.series({ - category: function (next) { - categories.create({ - name: 'Test Category', - description: 'Test category created by testing script', - }, next); - }, - adminUid: function (next) { - user.create({ username: 'admin', password: 'barbar' }, next); - }, - regularUid: function (next) { - user.create({ username: 'regular', password: 'zugzug' }, next); - }, - maliciousUid: function (next) { - user.create({ username: 'malicioususer', password: 'herpderp' }, next); - }, - }, (err, results) => { - if (err) { - return done(err); - } - adminUid = results.adminUid; - regularUid = results.regularUid; - maliciousUid = results.maliciousUid; - cid = results.category.cid; - - topics.post({ uid: adminUid, title: 'test topic title', content: 'test topic content', cid: results.category.cid }, (err, result) => { - if (err) { - return done(err); - } - tid = result.topicData.tid; - pid = result.postData.pid; - groups.join('administrators', adminUid, done); - }); + before(async () => { + const category = await categories.create({ + name: 'Test Category', + description: 'Test category created by testing script', }); + cid = category.cid; + + adminUid = await user.create({ username: 'admin', password: 'barbar' }); + groups.join('administrators', adminUid); + + regularUid = await user.create({ username: 'regular', password: 'zugzug' }); + maliciousUid = await user.create({ username: 'malicioususer', password: 'herpderp' }); + + const result = await topics.post({ uid: adminUid, title: 'test topic title', content: 'test topic content', cid }); + + tid = result.topicData.tid; + pid = result.postData.pid; }); describe('regular user uploads rate limits', () => { @@ -119,6 +101,19 @@ describe('Upload Controllers', () => { assert(body && body.status && body.response && body.response.images); assert(Array.isArray(body.response.images)); assert(body.response.images[0].url); + assert.deepStrictEqual(Object.keys(body.response.images[0]), ['url', 'name']); + }); + + it('should upload an svg image to a post', async () => { + const oldValue = meta.config.allowedFileExtensions; + meta.config.allowedFileExtensions = 'png,jpg,bmp,html,svg'; + const { response, body } = await helpers.uploadFile(`${nconf.get('url')}/api/post/upload`, path.join(__dirname, '../test/files/nodebb.svg'), {}, jar, csrf_token); + assert.equal(response.statusCode, 200); + assert(body && body.status && body.response && body.response.images); + assert(Array.isArray(body.response.images)); + assert(body.response.images[0].url); + assert.deepStrictEqual(Object.keys(body.response.images[0]), ['url', 'name']); + meta.config.allowedFileExtensions = oldValue; }); it('should upload an image to a post and then delete the upload', async () => { @@ -192,6 +187,7 @@ describe('Upload Controllers', () => { assert(body && body.status && body.response && body.response.images); assert(Array.isArray(body.response.images)); assert(body.response.images[0].url); + assert.deepStrictEqual(Object.keys(body.response.images[0]), ['url', 'name']); }); it('should upload a file with utf8 characters in the name to a post', async () => {