github-mirrors/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2025-12-15 06:24:23 +03:00
Code Issues Packages Projects Releases Wiki Activity

chore: additional filename validation

Browse Source
This commit is contained in:
izzy
2025-11-24 14:30:49 +00:00
parent fd6f043aa4
commit f84bdc14d5
2 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
server/src/services/maintenance.service.ts
View File

@@ -1,5 +1,5 @@
import { BadRequestException, Injectable } from '@nestjs/common';
import { join } from 'node:path';
import { basename, join } from 'node:path';
import { StorageCore } from 'src/cores/storage.core';
import { OnEvent } from 'src/decorators';
import { MaintenanceAuthDto, SetMaintenanceModeDto } from 'src/dtos/maintenance.dto';
@@ -82,7 +82,7 @@ export class MaintenanceService extends BaseService {
}
async deleteBackup(filename: string): Promise<void> {
return deleteBackup(this.backupRepos, filename);
return deleteBackup(this.backupRepos, basename(filename));
}
async uploadBackup(file: Express.Multer.File): Promise<void> {
@@ -94,7 +94,7 @@ export class MaintenanceService extends BaseService {
throw new BadRequestException('Invalid backup name!');
}
return join(StorageCore.getBaseFolder(StorageFolder.Backups), filename);
return join(StorageCore.getBaseFolder(StorageFolder.Backups), basename(filename));
}
private get backupRepos() {

3
server/src/validation.ts
View File

@@ -100,6 +100,9 @@ export class FilenameParamDto {
@IsNotEmpty()
@IsString()
@ApiProperty({ format: 'string' })
@Matches(/^[a-zA-Z0-9_\-\.]+$/, {
message: 'Filename contains invalid characters',
})
filename!: string;
}