next-tinacms-cloudinary 27.0.0 → 27.0.2

package/README.md

@@ -115,7 +115,7 @@ export default createMediaHandler({
       return true;
     }
     try {
-      const user = await isAuthorized(req);
+      const user = await isAuthorized(req, process.env.NEXT_PUBLIC_TINA_CLIENT_ID);
       return user && user.verified;
     } catch (e) {
       console.error(e);

package/dist/handlers.js

@@ -1,6 +1,7 @@
 // src/handlers.ts
 import { v2 as cloudinary } from "cloudinary";
 import path2 from "path";
+import os from "os";
 import multer from "multer";
 import { promisify } from "util";
 
@@ -80,6 +81,12 @@ function resolveDirectory(rawDirectory) {
   return normalized + "/";
 }
 
+// src/upload-filename.ts
+function safeUploadName(originalName) {
+  const base = originalName.split(/[/\\]/).pop() || "";
+  return base === "." || base === ".." ? "" : base;
+}
+
 // src/handlers.ts
 var mediaHandlerConfig = {
   api: {
@@ -110,12 +117,11 @@ async function uploadMedia(req, res) {
   const upload = promisify(
     multer({
       storage: multer.diskStorage({
-        // @ts-ignore
-        directory: (req2, file, cb) => {
-          cb(null, "/tmp");
+        destination: (req2, file, cb) => {
+          cb(null, os.tmpdir());
         },
         filename: (req2, file, cb) => {
-          cb(null, file.originalname);
+          cb(null, safeUploadName(file.originalname));
         }
       })
     }).single("file")

package/dist/upload-filename.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Strip any directory component from an uploaded filename so
+ * path.join(os.tmpdir(), name) can't escape the temp dir. Defense in depth:
+ * multer's parser already basenames the name, but don't rely on it.
+ * Duplicated byte-for-byte across the multer-based media adapters.
+ */
+export declare function safeUploadName(originalName: string): string;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "next-tinacms-cloudinary",
   "type": "module",
-  "version": "27.0.0",
+  "version": "27.0.2",
   "main": "dist/index.js",
   "module": "./dist/index.js",
   "files": [
@@ -31,10 +31,10 @@
     "react-dom": "^18.3.1",
     "typescript": "^5.7.3",
     "@tinacms/scripts": "1.6.2",
-    "tinacms": "3.10.0"
+    "tinacms": "3.11.0"
   },
   "peerDependencies": {
-    "tinacms": "3.10.0"
+    "tinacms": "^3.11.0"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org"