closes #4164

src/file.js

@@ -52,7 +52,7 @@ file.base64ToLocal = function(imageData, uploadPath, callback) {
 file.isFileTypeAllowed = function(path, callback) {
 	// Attempt to read the file, if it passes, file type is allowed
 	jimp.read(path, function(err) {
-		callback(err);
+		callback(err, path);
 	});
 };
 

src/groups/cover.js

@@ -9,6 +9,7 @@ var Jimp = require('jimp');
 
 
 var db = require('../database');
+var file = require('../file');
 var uploadsController = require('../controllers/uploads');
 
 module.exports = function(Groups) {
@@ -38,7 +39,11 @@ module.exports = function(Groups) {
 				writeImageDataToFile(data.imageData, next);
 			},
 			function (_tempPath, next) {
-				tempPath = _tempPath;
+				tempPath = _tempPath;	// set in local var so it can be deleted if file type invalid
+				next(null, tempPath);
+			},
+			async.apply(file.isFileTypeAllowed),
+			function (_tempPath, next) {
 				uploadsController.uploadGroupCover(uid, {
 					name: 'groupCover',
 					path: tempPath
@@ -65,7 +70,9 @@ module.exports = function(Groups) {
 			}
 		], function (err) {
 			if (err) {
-				return callback(err);
+				return fs.unlink(tempPath, function(unlinkErr) {
+					callback(err);	// send back original error
+				});
 			}
 
 			if (data.position) {

src/user/picture.js

@@ -168,6 +168,9 @@ module.exports = function(User) {
 				}, next);
 			},
 			function(next) {
+				file.isFileTypeAllowed(tempPath, next);
+			},
+			function(tempPath, next) {
 				var image = {
 					name: 'profileCover',
 					path: data.file ? data.file.path : tempPath,
@@ -204,7 +207,9 @@ module.exports = function(User) {
 			}
 		], function(err) {
 			if (err) {
-				return callback(err);
+				return fs.unlink(tempPath, function(unlinkErr) {
+					callback(err);	// send back the original error
+				});
 			}
 
 			if (data.position) {