Skip to content

fix: prevent req.file leak between sequential duplicate() calls on upload collections#15620

Open
jhb-dev wants to merge 1 commit intopayloadcms:mainfrom
jhb-dev:fix/uploads-req-file-leak-between-duplicate-calls
Open

fix: prevent req.file leak between sequential duplicate() calls on upload collections#15620
jhb-dev wants to merge 1 commit intopayloadcms:mainfrom
jhb-dev:fix/uploads-req-file-leak-between-duplicate-calls

Conversation

@jhb-dev
Copy link
Contributor

@jhb-dev jhb-dev commented Feb 13, 2026

What?

Prevents req.file from leaking between sequential payload.duplicate() calls when a shared req object is used for upload collections.

Why?

When calling payload.duplicate() multiple times on the same req object (e.g. in batch operations within a transaction), only the first document's file was used for all subsequent duplications. generateFileData writes the processed file back to req.file, and on the next call let file = req.file was truthy, so the block that fetches the correct source file from storage was skipped entirely.

How?

When isDuplicating is true, req.file is now ignored so the source file is always fetched fresh from storage for each duplicate operation. This is a one-line change in generateFileData.ts:

- let file = req.file
+ let file = isDuplicating ? undefined : req.file

An integration test was added that creates two upload documents with different files, duplicates both using a shared req, and asserts each duplicate derives its filename from the correct source document.

Fixes #15619

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

bug: req.file leaks between sequential duplicate() calls on upload collections

1 participant

Comments