next-tinacms-dos 24.0.0 → 24.0.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -122,7 +122,7 @@ export default createMediaHandler({
122
122
  return true;
123
123
  }
124
124
  try {
125
- const user = await isAuthorized(req);
125
+ const user = await isAuthorized(req, process.env.NEXT_PUBLIC_TINA_CLIENT_ID);
126
126
  return user && user.verified;
127
127
  } catch (e) {
128
128
  console.error(e);
package/dist/handlers.js CHANGED
@@ -7,6 +7,7 @@ import {
7
7
  } from "@aws-sdk/client-s3";
8
8
  import path2 from "path";
9
9
  import fs from "fs";
10
+ import os from "os";
10
11
  import multer from "multer";
11
12
 
12
13
  // src/media-key.ts
@@ -85,6 +86,12 @@ function resolveDirectory(rawDirectory) {
85
86
  return normalized + "/";
86
87
  }
87
88
 
89
+ // src/upload-filename.ts
90
+ function safeUploadName(originalName) {
91
+ const base = originalName.split(/[/\\]/).pop() || "";
92
+ return base === "." || base === ".." ? "" : base;
93
+ }
94
+
88
95
  // src/handlers.ts
89
96
  import { promisify } from "util";
90
97
  var mediaHandlerConfig = {
@@ -128,13 +135,11 @@ async function uploadMedia(req, res, client, bucket, mediaRoot, cdnUrl) {
128
135
  const upload = promisify(
129
136
  multer({
130
137
  storage: multer.diskStorage({
131
- // eslint-disable-next-line @typescript-eslint/ban-ts-comment
132
- // @ts-ignore
133
- directory: (req2, file, cb) => {
134
- cb(null, "/tmp");
138
+ destination: (req2, file, cb) => {
139
+ cb(null, os.tmpdir());
135
140
  },
136
141
  filename: (req2, file, cb) => {
137
- cb(null, file.originalname);
142
+ cb(null, safeUploadName(file.originalname));
138
143
  }
139
144
  })
140
145
  }).single("file")
@@ -0,0 +1,7 @@
1
+ /**
2
+ * Strip any directory component from an uploaded filename so
3
+ * path.join(os.tmpdir(), name) can't escape the temp dir. Defense in depth:
4
+ * multer's parser already basenames the name, but don't rely on it.
5
+ * Duplicated byte-for-byte across the multer-based media adapters.
6
+ */
7
+ export declare function safeUploadName(originalName: string): string;
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "next-tinacms-dos",
3
3
  "type": "module",
4
- "version": "24.0.0",
4
+ "version": "24.0.2",
5
5
  "main": "dist/index.js",
6
6
  "module": "./dist/index.js",
7
7
  "files": [
@@ -19,7 +19,7 @@
19
19
  ]
20
20
  },
21
21
  "peerDependencies": {
22
- "tinacms": "3.10.0"
22
+ "tinacms": "^3.11.0"
23
23
  },
24
24
  "devDependencies": {
25
25
  "@types/crypto-js": "^3.1.47",
@@ -29,8 +29,8 @@
29
29
  "react": "^18.3.1",
30
30
  "react-dom": "^18.3.1",
31
31
  "typescript": "^5.7.3",
32
- "@tinacms/scripts": "1.6.2",
33
- "tinacms": "3.10.0"
32
+ "tinacms": "3.11.0",
33
+ "@tinacms/scripts": "1.6.2"
34
34
  },
35
35
  "publishConfig": {
36
36
  "registry": "https://registry.npmjs.org"