dinawo
76dc23c861
Code security fixes: - Fixed 3 critical auth bypass bugs (user.jso, typo → user.json) in RenameFile, NewFolder, DeleteFolder API routes - Added URL validation (HTTP/HTTPS only) on ProfilPicture and BackgroundCustom endpoints to prevent stored XSS/CSS injection - Added path traversal protection in Upload.js (resolved path boundary check) - Removed unsafe-eval from CSP script-src directive - Removed information disclosure in BuildMetaData error responses - Removed unused child_process import in BuildMetaData.js Version bump: 1.2.1-beta → 1.2.2-beta
57 lines
1.6 KiB
JavaScript
57 lines
1.6 KiB
JavaScript
const express = require('express');
|
|
const fs = require('fs');
|
|
const path = require('path');
|
|
const router = express.Router();
|
|
|
|
router.use(express.json());
|
|
|
|
router.post('/wallpaper', (req, res) => {
|
|
const userId = req.body.userId;
|
|
const wallpaperUrl = req.body.wallpaperUrl;
|
|
|
|
if (!wallpaperUrl) {
|
|
return res.status(400).send('No wallpaper URL provided.');
|
|
}
|
|
|
|
// Validate URL to prevent XSS/CSS injection via malicious URLs
|
|
try {
|
|
const parsed = new URL(wallpaperUrl);
|
|
if (!['http:', 'https:'].includes(parsed.protocol)) {
|
|
return res.status(400).send('Invalid URL protocol. Only HTTP/HTTPS allowed.');
|
|
}
|
|
} catch {
|
|
return res.status(400).send('Invalid URL format.');
|
|
}
|
|
|
|
updateUserWallpaper(userId, wallpaperUrl, res);
|
|
});
|
|
|
|
const updateUserWallpaper = (userId, wallpaperUrl, res) => {
|
|
const userFilePath = path.join(__dirname, '../../../data', 'user.json');
|
|
|
|
fs.readFile(userFilePath, 'utf8', (err, data) => {
|
|
if (err) {
|
|
return res.status(500).send('Error reading the file');
|
|
}
|
|
|
|
let users = JSON.parse(data);
|
|
|
|
const userIndex = users.findIndex(u => u.id === userId);
|
|
|
|
if (userIndex !== -1) {
|
|
users[userIndex].wallpaper = wallpaperUrl;
|
|
|
|
fs.writeFile(userFilePath, JSON.stringify(users, null, 2), err => {
|
|
if (err) {
|
|
return res.status(500).send('Error writing to the file');
|
|
}
|
|
res.json({ wallpaper: wallpaperUrl });
|
|
});
|
|
} else {
|
|
res.status(404).send('User not found');
|
|
}
|
|
});
|
|
};
|
|
|
|
module.exports = router;
|