Reject illegal names

2024-08-16 16:34:43 +02:00
parent f1ff9f1c38
commit 5dba5471d1
3 changed files with 35 additions and 5 deletions
--- a/src/routes/+page.server.ts
+++ b/src/routes/+page.server.ts
@ -34,7 +34,12 @@ export const actions = {
 			return fail(400, { field: 'name', name: formName, incorrect: true });
 		}

-		const name = safePath(formName as string);
+		const name = formName as string;
+
+		if (!safePath(name, storagePath)) {
+			return fail(400, { field: 'name', name: name, incorrect: true });
+		}
+		// const name = safePath(formName as string);

 		files.forEach(async (file) => {
 			const outPath = `${storagePath}/${name}`;