feat(covert-to-module): address warnings

droppyjs · Sep 30, 2024 · b79a581 · b79a581
1 parent bbc5d96
commit b79a581
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 12 deletions.
diff --git a/packages/server/lib/services/server.js b/packages/server/lib/services/server.js
@@ -1046,6 +1046,7 @@ function handleUploadRequest(req, res) {
 
   const dstDir =
     decodeURIComponent(req.query.to) || clients[req.sid].views[vId].directory;
+
   let numFiles = 0;
 
   log.info(req, res, "Upload started");
@@ -1073,7 +1074,9 @@ function handleUploadRequest(req, res) {
 
   bb.on("file", (_, file, info) => {
     const { filename } = info;
-    if (!utils.isPathSane(filename) || !utils.isPathSane(dstDir)) return;
+    if (!utils.isPathSane(filename) || !utils.isPathSane(dstDir)) {
+      return;
+    }
     numFiles++;
 
     file.on("limit", () => {
@@ -1092,7 +1095,8 @@ function handleUploadRequest(req, res) {
     const tmpPath = utils.addUploadTempExt(filename);
     rootNames.add(utils.rootname(tmpPath));
 
-    const dst = path.join(paths.get().files, dstDir, tmpPath);
+    const dst = utils.addFilesPath(path.join(dstDir, tmpPath));
+
     utils.mkdir(path.dirname(dst), () => {
       fs.stat(dst, (err) => {
         if (err && err.code === "ENOENT") {
@@ -1125,12 +1129,9 @@ function handleUploadRequest(req, res) {
     // move temp files into place
     await Promise.all(
       [...rootNames].map(async (p) => {
-        const srcPath = path.join(paths.get().files, dstDir, p);
-        const dstPath = path.join(
-          paths.get().files,
-          dstDir,
-          utils.removeUploadTempExt(p)
-        );
+        const srcPath = utils.addFilesPath(path.join(dstDir, p));
+        const dstPath = utils.addFilesPath(path.join(dstDir, utils.removeUploadTempExt(p)));
+
         await promisify(utils.move)(srcPath, dstPath);
       })
     );
@@ -1146,7 +1147,9 @@ function handleUploadRequest(req, res) {
       // remove all uploaded temp files on cancel
       await Promise.all(
         [...rootNames].map(async (p) => {
-          await promisify(utils.rm)(path.join(paths.get().files, dstDir, p));
+
+
+          await promisify(utils.rm)(utils.addFilesPath(path.join(dstDir, p)));
         })
       );
 

diff --git a/packages/server/lib/services/utils.js b/packages/server/lib/services/utils.js
@@ -167,9 +167,15 @@ class DroppyUtils {
   }
 
   addFilesPath(p) {
-    return p === "/"
-      ? paths.get().files
-      : path.join(`${paths.get().files}/${p}`);
+    const filesPath = path.resolve(
+      p === "/" ? paths.get().files : path.join(`${paths.get().files}/${p}`)
+    );
+
+    if (!filesPath.startsWith(path.resolve(paths.get().files))) {
+      return paths.get().files;
+    }
+
+    return filesPath;
   }
 
   removeFilesPath(p) {