Mirror/filesafe
1
0
Fork 0
mirror of https://github.com/BobbyWibowo/lolisafe.git synced 2025-01-19 01:31:34 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

added array with blocked file extensions

Browse Source 
Added an option to add file extensions to the config which will be rejected (https://github.com/WeebDev/loli-safe/issues/19)
This commit is contained in:
Onestay 2017-03-27 23:07:00 +02:00
parent 5951803f66
commit ad6b7d25de
2 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
config.sample.js
View File

@ -4,7 +4,6 @@ module.exports = {
If set to true the user will need to specify the auto-generated token If set to true the user will need to specify the auto-generated token
on each API call, meaning random strangers wont be able to use the service on each API call, meaning random strangers wont be able to use the service
unless they have the token loli-safe provides you with. unless they have the token loli-safe provides you with.
If it's set to false, then upload will be public for anyone to use. If it's set to false, then upload will be public for anyone to use.
*/ */
private: true, private: true,
@ -34,6 +33,14 @@ module.exports = {
// Pages to process for the frontend // Pages to process for the frontend
pages: ['home', 'auth', 'dashboard', 'faq'], pages: ['home', 'auth', 'dashboard', 'faq'],
// Add file extensions here which should be blocked
blockedExtensions: [
'.exe',
'.bat',
'.cmd',
'.msi'
],
// Uploads config // Uploads config
uploads: { uploads: {

8
controllers/uploadController.js
View File

@ -20,7 +20,13 @@ const storage = multer.diskStorage({
const upload = multer({ const upload = multer({
storage: storage, storage: storage,
limits: { fileSize: config.uploads.maxSize } limits: { fileSize: config.uploads.maxSize },
fileFilter: function(req, file, cb) {
if (config.blockedExtensions.some((extension) => { return path.extname(file.originalname) === extension; })) {
return cb('This file extension is not allowed');
}
return cb(null, true);
}
}).array('files[]') }).array('files[]')
uploadsController.upload = function(req, res, next) { uploadsController.upload = function(req, res, next) {