GHSA-pjj3-j5j6-qj27

Author: btopro

src/routes/listFiles.js

@@ -22,44 +22,46 @@ const mime = require('mime');
   async function listFiles(req, res) {
     let files = [];
     let site = await HAXCMS.loadSite(req.query['siteName']);
-    let search = (typeof req.query['filename'] !== 'undefined') ? req.query['filename'] : '';
-    // build files directory path
-    let siteFilePath = path.join(site.siteDirectory, 'files');
-    let handle;
-    if (handle = fs.readdirSync(siteFilePath)) {
-      handle.forEach(file => {
-        if (
-            file != "." &&
-            file != ".." &&
-            file != '.gitkeep' &&
-            file != '.DS_Store'
-        ) {
-          // ensure this is a file
+    if (site && site.siteDirectory) {
+      let search = (typeof req.query['filename'] !== 'undefined') ? req.query['filename'] : '';
+      // build files directory path
+      let siteFilePath = path.join(site.siteDirectory, 'files');
+      let handle;
+      if (handle = fs.readdirSync(siteFilePath)) {
+        handle.forEach(file => {
           if (
-            fs.lstatSync(siteFilePath + '/' + file).isFile()
+              file != "." &&
+              file != ".." &&
+              file != '.gitkeep' &&
+              file != '.DS_Store'
           ) {
-            // ensure this is a file and if we are searching for results then return only exact ones
-            if (search == "" || file.indexOf(search) !== -1) {
-              let fullUrl = '/files/' + file;
-              // multiple sites then append the base url to site management area
-              if (HAXCMS.operatingContext == 'multisite') {
-                fullUrl = HAXCMS.basePath +
-                HAXCMS.sitesDirectory + '/' +
-                site.manifest.metadata.site.name + '/files/' + file
+            // ensure this is a file
+            if (
+              fs.lstatSync(siteFilePath + '/' + file).isFile()
+            ) {
+              // ensure this is a file and if we are searching for results then return only exact ones
+              if (search == "" || file.indexOf(search) !== -1) {
+                let fullUrl = '/files/' + file;
+                // multiple sites then append the base url to site management area
+                if (HAXCMS.operatingContext == 'multisite') {
+                  fullUrl = HAXCMS.basePath +
+                  HAXCMS.sitesDirectory + '/' +
+                  site.manifest.metadata.site.name + '/files/' + file
+                }
+                files.push({
+                  'path' : 'files/' + file,
+                  'fullUrl' : fullUrl,
+                  'url' : 'files/' + file,
+                  'mimetype' : mime.getType(siteFilePath + '/' + file),
+                  'name' : file
+                });
               }
-              files.push({
-                'path' : 'files/' + file,
-                'fullUrl' : fullUrl,
-                'url' : 'files/' + file,
-                'mimetype' : mime.getType(siteFilePath + '/' + file),
-                'name' : file
-              });
+            } else {
+                // @todo maybe step into directories?
             }
-          } else {
-              // @todo maybe step into directories?
           }
-        }
-      });
+        });
+      }
     }
     res.send(files);
   }

src/routes/saveFile.js

@@ -50,27 +50,34 @@ const HAXCMSFile = require('../lib/HAXCMSFile.js');
    * )
    */
   async function saveFile(req, res, next) {
-    if (req.file.fieldname == 'file-upload') {
+    let sendResult = 500;
+    if (
+      req.file &&
+      req.file.fieldname == 'file-upload' && 
+      req.query && 
+      req.query['siteName'] && 
+      req.query['nodeId']
+    ) {
       let site = await HAXCMS.loadSite(req.query['siteName']);
-      // update the page's content, using manifest to find it
-      // this ensures that writing is always to what the file system
-      // determines to be the correct page
-      let page = site.loadNode(req.query['nodeId']);
-      let upload = req.file;
-      upload.name = upload.originalname;
-      upload.tmp_name = path.join("./", upload.path);
-      let file = new HAXCMSFile();
-      let fileResult = await file.save(upload, site, page);
-      if (!fileResult || fileResult['status'] == 500) {
-        res.send(500);
+      if (site) {
+        // update the page's content, using manifest to find it
+        // this ensures that writing is always to what the file system
+        // determines to be the correct page
+        let page = site.loadNode(req.query['nodeId']);
+        let upload = req.file;
+        upload.name = upload.originalname;
+        upload.tmp_name = path.join("./", upload.path);
+        let file = new HAXCMSFile();
+        let fileResult = await file.save(upload, site, page);
+        if (!fileResult || fileResult['status'] == 500) {
+          // do nothing so we can 500
+        }
+        else {
+          await site.gitCommit('File added: ' + upload['name']);
+          sendResult = fileResult;
+        }
       }
-      else {
-        await site.gitCommit('File added: ' + upload['name']);
-        res.send(fileResult);  
-      }
-    }
-    else {
-      res.send(500);
     }
+    res.send(sendResult);
   }
   module.exports = saveFile;