mirror/advplyr.audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2025-06-23 17:29:19 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Update upload API endpoint to validate request body

Browse source
This commit is contained in:
advplyr 2025-04-27 09:18:52 -05:00
parent ec05bd36e4
commit 35870a0158
2 changed files with 16 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

22
server/controllers/MiscController.js
View file

@ -37,25 +37,31 @@ class MiscController {
Logger.warn(`User "${req.user.username}" attempted to upload without permission`)
return res.sendStatus(403)
}
if (!req.files) {
if (!req.files || !Object.values(req.files).length) {
Logger.error('Invalid request, no files')
return res.sendStatus(400)
}
const files = Object.values(req.files)
const { title, author, series, folder: folderId, library: libraryId } = req.body
let { title, author, series, folder: folderId, library: libraryId } = req.body
// Validate request body
if (!libraryId || !folderId || typeof libraryId !== 'string' || typeof folderId !== 'string' || !title || typeof title !== 'string') {
return res.status(400).send('Invalid request body')
}
if (!series || typeof series !== 'string') {
series = null
}
if (!author || typeof author !== 'string') {
author = null
}
const library = await Database.libraryModel.findByIdWithFolders(libraryId)
if (!library) {
return res.status(404).send(`Library not found with id ${libraryId}`)
return res.status(404).send('Library not found')
}
const folder = library.libraryFolders.find((fold) => fold.id === folderId)
if (!folder) {
return res.status(404).send(`Folder not found with id ${folderId} in library ${library.name}`)
}
if (!files.length || !title) {
return res.status(500).send(`Invalid post data`)
return res.status(404).send('Folder not found')
}
// Podcasts should only be one folder deep