gaschz/trilium
1
0
Fork 0
mirror of https://github.com/zadam/trilium.git synced 2025-03-01 14:22:32 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

verify that the uploaded modified file is temporary

Browse Source 
(cherry picked from commit a2711cfb7b5b454182393aa160e45ccbf52c949d)
This commit is contained in:
zadam 2024-05-18 05:50:46 +02:00
parent 3035473751
commit a88bf68eb6
2 changed files with 5845 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5837
package-lock.json generated
View File

File diff suppressed because it is too large Load Diff

8
src/routes/api/files.js
View File

@ -154,12 +154,16 @@ function saveAttachmentToTmpDir(req) {
return saveToTmpDir(fileName, content, 'attachments', attachment.attachmentId); return saveToTmpDir(fileName, content, 'attachments', attachment.attachmentId);
} }
const createdTemporaryFiles = new Set();
function saveToTmpDir(fileName, content, entityType, entityId) { function saveToTmpDir(fileName, content, entityType, entityId) {
const tmpObj = tmp.fileSync({ postfix: fileName }); const tmpObj = tmp.fileSync({ postfix: fileName });
fs.writeSync(tmpObj.fd, content); fs.writeSync(tmpObj.fd, content);
fs.closeSync(tmpObj.fd); fs.closeSync(tmpObj.fd);
createdTemporaryFiles.add(tmpObj.name);
log.info(`Saved temporary file ${tmpObj.name}`); log.info(`Saved temporary file ${tmpObj.name}`);
if (utils.isElectron()) { if (utils.isElectron()) {
@ -183,6 +187,10 @@ function uploadModifiedFileToNote(req) {
const noteId = req.params.noteId; const noteId = req.params.noteId;
const {filePath} = req.body; const {filePath} = req.body;
if (!createdTemporaryFiles.has(filePath)) {
throw new ValidationError(`File '${filePath}' is not a temporary file.`);
}
const note = becca.getNoteOrThrow(noteId); const note = becca.getNoteOrThrow(noteId);
log.info(`Updating note '${noteId}' with content from '${filePath}'`); log.info(`Updating note '${noteId}' with content from '${filePath}'`);