paul/picpeak
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Harden photo resolver path handling
Test and Lint / backend-test (push) Successful in 1m37s
Details
Test and Lint / frontend-test (push) Has been cancelled
Details

Browse Source
This commit is contained in:
paul
2025-09-22 18:59:49 +02:00
parent 0024686dc2
commit c1be7d6785
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/photoResolver.js
+8 -2
View File
@@ -1,5 +1,6 @@
const path = require('path'); const path = require('path');
const { resolveExternalPath } = require('./externalMediaService'); const { resolveExternalPath } = require('./externalMediaService');
const { safePathJoin } = require('../utils/fileSecurityUtils');
const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage'); const getStoragePath = () => process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
@@ -33,10 +34,15 @@ function resolvePhotoFilePath(event, photo) {
} }
const storagePath = getStoragePath(); const storagePath = getStoragePath();
const eventsRoot = path.join(storagePath, 'events/active');
if (photo.path && photo.path.startsWith('events/active/')) { if (photo.path && photo.path.startsWith('events/active/')) {
return path.join(storagePath, photo.path); // Legacy paths already include prefix; normalize via safe join
return safePathJoin(storagePath, photo.path.replace(/^events\/active\/?/, 'events/active/'));
} }
return path.join(storagePath, 'events/active', photo.path || '');
const relativeSegment = photo.path ? photo.path.replace(/^\/+/, '') : '';
return safePathJoin(eventsRoot, relativeSegment);
} }
module.exports = { module.exports = {