CDN-APP-INSIDER/routes/Dpanel/API/BackgroundCustom.js

const express = require('express');
const fs = require('fs');
const path = require('path');
const router = express.Router();

router.use(express.json());

router.post('/wallpaper', (req, res) => {
    const userId = req.body.userId;
    const wallpaperUrl = req.body.wallpaperUrl;

    if (!wallpaperUrl) {
        return res.status(400).send('No wallpaper URL provided.');
    }

    // Validate URL to prevent XSS/CSS injection via malicious URLs
    try {
        const parsed = new URL(wallpaperUrl);
        if (!['http:', 'https:'].includes(parsed.protocol)) {
            return res.status(400).send('Invalid URL protocol. Only HTTP/HTTPS allowed.');
        }
    } catch {
        return res.status(400).send('Invalid URL format.');
    }

    updateUserWallpaper(userId, wallpaperUrl, res);
});

const updateUserWallpaper = (userId, wallpaperUrl, res) => {
    const userFilePath = path.join(__dirname, '../../../data', 'user.json');

    fs.readFile(userFilePath, 'utf8', (err, data) => {
        if (err) {
            return res.status(500).send('Error reading the file');
        }

        let users = JSON.parse(data);

        const userIndex = users.findIndex(u => u.id === userId);

        if (userIndex !== -1) {
            users[userIndex].wallpaper = wallpaperUrl;

            fs.writeFile(userFilePath, JSON.stringify(users, null, 2), err => {
                if (err) {
                    return res.status(500).send('Error writing to the file');
                }
                res.json({ wallpaper: wallpaperUrl });
            });
        } else {
            res.status(404).send('User not found');
        }
    });
};

module.exports = router;