Skip to content

Commit

Permalink
fix(tickets): security fix 4 #413
Browse files Browse the repository at this point in the history
  • Loading branch information
polonel committed Jun 16, 2021
1 parent 648e369 commit caaec12
Showing 1 changed file with 28 additions and 0 deletions.
28 changes: 28 additions & 0 deletions src/controllers/tickets.js
Original file line number Diff line number Diff line change
Expand Up @@ -531,6 +531,34 @@ ticketsController.uploadImageMDE = function (req, res) {
}

var ext = path.extname(filename)
var allowedExtensions = [
'.jpg',
'.jpeg',
'.jpe',
'.jif',
'.jfif',
'.jfi',
'.png',
'.gif',
'.webp',
'.tiff',
'.tif',
'.bmp',
'.dib',
'.heif',
'.heic',
'.svg',
'.svgz'
]

if (!allowedExtensions.includes(ext.toLocaleLowerCase())) {
error = {
status: 400,
message: 'Invalid File Type'
}

return file.resume()
}

var savePath = path.join(__dirname, '../../public/uploads/tickets', object.ticketId)
// var sanitizedFilename = filename.replace(/[^a-z0-9.]/gi, '_').toLowerCase();
Expand Down

0 comments on commit caaec12

Please sign in to comment.