Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-11-16 02:36:16 +01:00
Code Issues Packages Projects Releases Wiki Activity

feat(writeapi): file deletion route

Browse Source
This commit is contained in:
Julian Lam
2020-10-08 12:00:06 -04:00
parent a55b381791
commit f870721fca
8 changed files with 115 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

56
src/middleware/assert.js
View File

@@ -5,44 +5,74 @@
* payload and throw an error otherwise.
*/
const fs = require('fs');
const fsPromises = fs.promises;
const path = require('path');
const nconf = require('nconf');
const user = require('../user');
const groups = require('../groups');
const topics = require('../topics');
const posts = require('../posts');
const helpers = require('../controllers/helpers');
const helpers = require('./helpers');
const controllerHelpers = require('../controllers/helpers');
module.exports = function (middleware) {
middleware.assertUser = async (req, res, next) => {
middleware.assertUser = helpers.try(async (req, res, next) => {
if (!await user.exists(req.params.uid)) {
return helpers.formatApiResponse(404, res, new Error('[[error:no-user]]'));
return controllerHelpers.formatApiResponse(404, res, new Error('[[error:no-user]]'));
}
next();
};
});
middleware.assertGroup = async (req, res, next) => {
middleware.assertGroup = helpers.try(async (req, res, next) => {
const name = await groups.getGroupNameByGroupSlug(req.params.slug);
if (!name || !await groups.exists(name)) {
return helpers.formatApiResponse(404, res, new Error('[[error:no-group]]'));
return controllerHelpers.formatApiResponse(404, res, new Error('[[error:no-group]]'));
}
next();
};
});
middleware.assertTopic = async (req, res, next) => {
middleware.assertTopic = helpers.try(async (req, res, next) => {
if (!await topics.exists(req.params.tid)) {
return helpers.formatApiResponse(404, res, new Error('[[error:no-topic]]'));
return controllerHelpers.formatApiResponse(404, res, new Error('[[error:no-topic]]'));
}
next();
};
});
middleware.assertPost = async (req, res, next) => {
middleware.assertPost = helpers.try(async (req, res, next) => {
if (!await posts.exists(req.params.pid)) {
return helpers.formatApiResponse(404, res, new Error('[[error:no-topic]]'));
return controllerHelpers.formatApiResponse(404, res, new Error('[[error:no-topic]]'));
}
next();
};
});
middleware.assertPath = helpers.try(async (req, res, next) => {
// file: URL support
if (req.body.path.startsWith('file:///')) {
req.body.path = new URL(req.body.path).pathname;
}
// Checks file exists and is within bounds of upload_path
const pathToFile = path.join(nconf.get('upload_path'), req.body.path);
res.locals.cleanedPath = pathToFile;
if (!pathToFile.startsWith(nconf.get('upload_path'))) {
return controllerHelpers.formatApiResponse(403, res, new Error('[[error:invalid-path]]'));
}
try {
await fsPromises.access(pathToFile, fs.constants.F_OK);
} catch (e) {
return controllerHelpers.formatApiResponse(404, res, new Error('[[error:invalid-path]]'));
}
next();
});
};