CDN-APP-INSIDER/routes/Dpanel/API/ProfilPicture.js

const express = require('express');
const fs = require('fs');
const path = require('path');
const router = express.Router();

router.use(express.json());

router.post('/', (req, res) => {
    const userId = req.body.userId;
    const profilePictureUrl = req.body.profilePictureUrl;

    if (!profilePictureUrl) {
        return res.status(400).send('No profile picture URL provided.');
    }

    // Validate URL to prevent XSS/injection via malicious URLs
    try {
        const parsed = new URL(profilePictureUrl);
        if (!['http:', 'https:'].includes(parsed.protocol)) {
            return res.status(400).send('Invalid URL protocol. Only HTTP/HTTPS allowed.');
        }
    } catch {
        return res.status(400).send('Invalid URL format.');
    }

    updateUserProfilePicture(userId, profilePictureUrl, res);
});

const updateUserProfilePicture = (userId, profilePictureUrl, res) => {
    const userFilePath = path.join(__dirname, '../../../data', 'user.json');

    fs.readFile(userFilePath, 'utf8', (err, data) => {
        if (err) {
            return res.status(500).send('Error reading the file');
        }

        let users = JSON.parse(data);

        const userIndex = users.findIndex(u => u.id === userId);

        if (userIndex !== -1) {
            users[userIndex].profilePicture = profilePictureUrl;

            fs.writeFile(userFilePath, JSON.stringify(users, null, 2), err => {
                if (err) {
                    return res.status(500).send('Error writing to the file');
                }
                res.json({ profilePicture: profilePictureUrl });
            });
        } else {
            res.status(404).send('User not found');
        }
    });
};

module.exports = router;