Peps
/
v3.0.0
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Update uploadController.js 

* fixed blacklist from being bypassed due to case insensitive extension names
This commit is contained in:
EpikPhailure 2017-06-22 17:35:56 -07:00 committed by GitHub
parent 2a978df1a7
commit daf8f0130c
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
controllers/uploadController.js
View File

@ -23,7 +23,7 @@ const upload = multer({
limits: { fileSize: config.uploads.maxSize },
fileFilter: function(req, file, cb) {
if (config.blockedExtensions !== undefined) {
if (config.blockedExtensions.some(extension => path.extname(file.originalname) === extension)) {
if (config.blockedExtensions.some(extension => path.extname(file.originalname).toLowerCase() === extension)) {
return cb('This file extension is not allowed');
}
return cb(null, true);