Mirror/filesafe
1
0
Fork 0
mirror of https://github.com/BobbyWibowo/lolisafe.git synced 2024-12-13 07:56:23 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update uploadController.js

Browse Source 
* fixed blacklist from being bypassed due to case insensitive extension names
This commit is contained in:
EpikPhailure 2017-06-22 17:35:56 -07:00 committed by GitHub
parent 2a978df1a7
commit daf8f0130c
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
controllers/uploadController.js
View File

@ -23,7 +23,7 @@ const upload = multer({
limits: { fileSize: config.uploads.maxSize },
fileFilter: function(req, file, cb) {
if (config.blockedExtensions !== undefined) {
if (config.blockedExtensions.some(extension => path.extname(file.originalname) === extension)) {
if (config.blockedExtensions.some(extension => path.extname(file.originalname).toLowerCase() === extension)) {
return cb('This file extension is not allowed');
}
return cb(null, true);