next-tinacms-dos 24.0.0 → 24.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/dist/handlers.js +10 -5
- package/dist/upload-filename.d.ts +7 -0
- package/package.json +4 -4
package/README.md
CHANGED
|
@@ -122,7 +122,7 @@ export default createMediaHandler({
|
|
|
122
122
|
return true;
|
|
123
123
|
}
|
|
124
124
|
try {
|
|
125
|
-
const user = await isAuthorized(req);
|
|
125
|
+
const user = await isAuthorized(req, process.env.NEXT_PUBLIC_TINA_CLIENT_ID);
|
|
126
126
|
return user && user.verified;
|
|
127
127
|
} catch (e) {
|
|
128
128
|
console.error(e);
|
package/dist/handlers.js
CHANGED
|
@@ -7,6 +7,7 @@ import {
|
|
|
7
7
|
} from "@aws-sdk/client-s3";
|
|
8
8
|
import path2 from "path";
|
|
9
9
|
import fs from "fs";
|
|
10
|
+
import os from "os";
|
|
10
11
|
import multer from "multer";
|
|
11
12
|
|
|
12
13
|
// src/media-key.ts
|
|
@@ -85,6 +86,12 @@ function resolveDirectory(rawDirectory) {
|
|
|
85
86
|
return normalized + "/";
|
|
86
87
|
}
|
|
87
88
|
|
|
89
|
+
// src/upload-filename.ts
|
|
90
|
+
function safeUploadName(originalName) {
|
|
91
|
+
const base = originalName.split(/[/\\]/).pop() || "";
|
|
92
|
+
return base === "." || base === ".." ? "" : base;
|
|
93
|
+
}
|
|
94
|
+
|
|
88
95
|
// src/handlers.ts
|
|
89
96
|
import { promisify } from "util";
|
|
90
97
|
var mediaHandlerConfig = {
|
|
@@ -128,13 +135,11 @@ async function uploadMedia(req, res, client, bucket, mediaRoot, cdnUrl) {
|
|
|
128
135
|
const upload = promisify(
|
|
129
136
|
multer({
|
|
130
137
|
storage: multer.diskStorage({
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
directory: (req2, file, cb) => {
|
|
134
|
-
cb(null, "/tmp");
|
|
138
|
+
destination: (req2, file, cb) => {
|
|
139
|
+
cb(null, os.tmpdir());
|
|
135
140
|
},
|
|
136
141
|
filename: (req2, file, cb) => {
|
|
137
|
-
cb(null, file.originalname);
|
|
142
|
+
cb(null, safeUploadName(file.originalname));
|
|
138
143
|
}
|
|
139
144
|
})
|
|
140
145
|
}).single("file")
|
|
@@ -0,0 +1,7 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Strip any directory component from an uploaded filename so
|
|
3
|
+
* path.join(os.tmpdir(), name) can't escape the temp dir. Defense in depth:
|
|
4
|
+
* multer's parser already basenames the name, but don't rely on it.
|
|
5
|
+
* Duplicated byte-for-byte across the multer-based media adapters.
|
|
6
|
+
*/
|
|
7
|
+
export declare function safeUploadName(originalName: string): string;
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "next-tinacms-dos",
|
|
3
3
|
"type": "module",
|
|
4
|
-
"version": "24.0.
|
|
4
|
+
"version": "24.0.2",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"module": "./dist/index.js",
|
|
7
7
|
"files": [
|
|
@@ -19,7 +19,7 @@
|
|
|
19
19
|
]
|
|
20
20
|
},
|
|
21
21
|
"peerDependencies": {
|
|
22
|
-
"tinacms": "3.
|
|
22
|
+
"tinacms": "^3.11.0"
|
|
23
23
|
},
|
|
24
24
|
"devDependencies": {
|
|
25
25
|
"@types/crypto-js": "^3.1.47",
|
|
@@ -29,8 +29,8 @@
|
|
|
29
29
|
"react": "^18.3.1",
|
|
30
30
|
"react-dom": "^18.3.1",
|
|
31
31
|
"typescript": "^5.7.3",
|
|
32
|
-
"
|
|
33
|
-
"tinacms": "
|
|
32
|
+
"tinacms": "3.11.0",
|
|
33
|
+
"@tinacms/scripts": "1.6.2"
|
|
34
34
|
},
|
|
35
35
|
"publishConfig": {
|
|
36
36
|
"registry": "https://registry.npmjs.org"
|