Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-10-26 16:46:12 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: sanitize svg when uploading site-logo, default avatar and og:image

Browse Source
This commit is contained in:
Barış Soner Uşaklı
2025-06-11 17:13:56 -04:00
parent dc37789b5d
commit da2597f81c
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/controllers/admin/uploads.js
View File

@@ -258,10 +258,6 @@ uploadsController.uploadMaskableIcon = async function (req, res, next) {
} }
}; };
uploadsController.uploadLogo = async function (req, res, next) {
await upload('site-logo', req, res, next);
};
uploadsController.uploadFile = async function (req, res, next) { uploadsController.uploadFile = async function (req, res, next) {
const uploadedFile = req.files.files[0]; const uploadedFile = req.files.files[0];
let params; let params;
@@ -285,6 +281,10 @@ uploadsController.uploadFile = async function (req, res, next) {
} }
}; };
uploadsController.uploadLogo = async function (req, res, next) {
await upload('site-logo', req, res, next);
};
uploadsController.uploadDefaultAvatar = async function (req, res, next) { uploadsController.uploadDefaultAvatar = async function (req, res, next) {
await upload('avatar-default', req, res, next); await upload('avatar-default', req, res, next);
}; };
@@ -296,6 +296,10 @@ uploadsController.uploadOgImage = async function (req, res, next) {
async function upload(name, req, res, next) { async function upload(name, req, res, next) {
const uploadedFile = req.files.files[0]; const uploadedFile = req.files.files[0];
if (uploadedFile.path.endsWith('.svg')) {
await sanitizeSvg(uploadedFile.path);
}
await validateUpload(uploadedFile, allowedImageTypes); await validateUpload(uploadedFile, allowedImageTypes);
const filename = name + path.extname(uploadedFile.name); const filename = name + path.extname(uploadedFile.name);
await uploadImage(filename, 'system', uploadedFile, req, res, next); await uploadImage(filename, 'system', uploadedFile, req, res, next);