next-tinacms-cloudinary 27.0.1 → 27.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/handlers.js +10 -4
- package/dist/upload-filename.d.ts +7 -0
- package/package.json +3 -3
package/dist/handlers.js
CHANGED
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
// src/handlers.ts
|
|
2
2
|
import { v2 as cloudinary } from "cloudinary";
|
|
3
3
|
import path2 from "path";
|
|
4
|
+
import os from "os";
|
|
4
5
|
import multer from "multer";
|
|
5
6
|
import { promisify } from "util";
|
|
6
7
|
|
|
@@ -80,6 +81,12 @@ function resolveDirectory(rawDirectory) {
|
|
|
80
81
|
return normalized + "/";
|
|
81
82
|
}
|
|
82
83
|
|
|
84
|
+
// src/upload-filename.ts
|
|
85
|
+
function safeUploadName(originalName) {
|
|
86
|
+
const base = originalName.split(/[/\\]/).pop() || "";
|
|
87
|
+
return base === "." || base === ".." ? "" : base;
|
|
88
|
+
}
|
|
89
|
+
|
|
83
90
|
// src/handlers.ts
|
|
84
91
|
var mediaHandlerConfig = {
|
|
85
92
|
api: {
|
|
@@ -110,12 +117,11 @@ async function uploadMedia(req, res) {
|
|
|
110
117
|
const upload = promisify(
|
|
111
118
|
multer({
|
|
112
119
|
storage: multer.diskStorage({
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
cb(null, "/tmp");
|
|
120
|
+
destination: (req2, file, cb) => {
|
|
121
|
+
cb(null, os.tmpdir());
|
|
116
122
|
},
|
|
117
123
|
filename: (req2, file, cb) => {
|
|
118
|
-
cb(null, file.originalname);
|
|
124
|
+
cb(null, safeUploadName(file.originalname));
|
|
119
125
|
}
|
|
120
126
|
})
|
|
121
127
|
}).single("file")
|
|
@@ -0,0 +1,7 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Strip any directory component from an uploaded filename so
|
|
3
|
+
* path.join(os.tmpdir(), name) can't escape the temp dir. Defense in depth:
|
|
4
|
+
* multer's parser already basenames the name, but don't rely on it.
|
|
5
|
+
* Duplicated byte-for-byte across the multer-based media adapters.
|
|
6
|
+
*/
|
|
7
|
+
export declare function safeUploadName(originalName: string): string;
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "next-tinacms-cloudinary",
|
|
3
3
|
"type": "module",
|
|
4
|
-
"version": "27.0.
|
|
4
|
+
"version": "27.0.2",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"module": "./dist/index.js",
|
|
7
7
|
"files": [
|
|
@@ -31,10 +31,10 @@
|
|
|
31
31
|
"react-dom": "^18.3.1",
|
|
32
32
|
"typescript": "^5.7.3",
|
|
33
33
|
"@tinacms/scripts": "1.6.2",
|
|
34
|
-
"tinacms": "3.
|
|
34
|
+
"tinacms": "3.11.0"
|
|
35
35
|
},
|
|
36
36
|
"peerDependencies": {
|
|
37
|
-
"tinacms": "3.
|
|
37
|
+
"tinacms": "^3.11.0"
|
|
38
38
|
},
|
|
39
39
|
"publishConfig": {
|
|
40
40
|
"registry": "https://registry.npmjs.org"
|