@actual-app/sync-server 25.11.0-nightly.20251026 → 25.11.0-nightly.20251028
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/build/src/app-sync.js +8 -1
- package/package.json +2 -2
package/build/src/app-sync.js
CHANGED
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
// @ts-strict-ignore
|
|
2
2
|
import { Buffer } from 'node:buffer';
|
|
3
3
|
import fs from 'node:fs/promises';
|
|
4
|
+
import { resolve } from 'node:path';
|
|
4
5
|
import { SyncProtoBuf } from '@actual-app/crdt';
|
|
5
6
|
import express from 'express';
|
|
6
7
|
import { v4 as uuidv4 } from 'uuid';
|
|
@@ -226,8 +227,14 @@ app.get('/download-user-file', async (req, res) => {
|
|
|
226
227
|
if (!verifyFileExists(fileId, filesService, res, 'User or file not found')) {
|
|
227
228
|
return;
|
|
228
229
|
}
|
|
230
|
+
const path = getPathForUserFile(fileId);
|
|
231
|
+
if (!path.startsWith(resolve(config.get('userFiles')))) {
|
|
232
|
+
//Ensure the user doesn't try to access files outside of the user files directory
|
|
233
|
+
res.status(403).send('Access denied');
|
|
234
|
+
return;
|
|
235
|
+
}
|
|
229
236
|
res.setHeader('Content-Disposition', `attachment;filename=${fileId}`);
|
|
230
|
-
res.sendFile(
|
|
237
|
+
res.sendFile(path, { dotfiles: 'allow' });
|
|
231
238
|
});
|
|
232
239
|
app.post('/update-user-filename', (req, res) => {
|
|
233
240
|
const { fileId, name } = req.body || {};
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@actual-app/sync-server",
|
|
3
|
-
"version": "25.11.0-nightly.
|
|
3
|
+
"version": "25.11.0-nightly.20251028",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"description": "actual syncing server",
|
|
6
6
|
"bin": {
|
|
@@ -28,7 +28,7 @@
|
|
|
28
28
|
},
|
|
29
29
|
"dependencies": {
|
|
30
30
|
"@actual-app/crdt": "2.1.0",
|
|
31
|
-
"@actual-app/web": "25.11.0-nightly.
|
|
31
|
+
"@actual-app/web": "25.11.0-nightly.20251028",
|
|
32
32
|
"bcrypt": "^6.0.0",
|
|
33
33
|
"better-sqlite3": "^12.4.1",
|
|
34
34
|
"convict": "^6.2.4",
|