nodebb-plugin-customize 5.0.0 → 5.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -0,0 +1,16 @@
1
+ 404 cuastom 1
2
+ <div class="flex-fill">
3
+ 404 cuastom
4
+ <h2 class="fw-semibold tracking-tight text-center">{{tx("global:404.title")}}</h2>
5
+
6
+ <div class="mx-auto">
7
+ <div class="d-flex flex-column gap-3 justify-content-center text-center">
8
+ <div class="mx-auto p-4">
9
+ <i class="text-secondary fa fa-fw fa-4x {{{ if icon }}}{icon}{{{ else }}}fa-otter{{{ end }}}"></i>
10
+ </div>
11
+ {{{ if error }}}{{tx(error)}}{{{ else }}}{{tx("global:404.message", config.relative_path)}}{{{ end }}}
12
+ </div>
13
+ </div>
14
+ {{tx("global:posts")}} wow
15
+ </div>
16
+
package/lib/database.ts CHANGED
@@ -1,7 +1,7 @@
1
1
  // types and helper functions for database
2
2
 
3
3
  import { promisify } from 'util';
4
- import { join } from 'path';
4
+ import { join, resolve, sep } from 'path';
5
5
  import { readJson, readFile } from 'fs-extra';
6
6
  import { applyPatch } from 'diff';
7
7
 
@@ -132,11 +132,19 @@ export async function getTemplates(): Promise<Template[]> {
132
132
  });
133
133
  }
134
134
 
135
+ function assertPathWithinViews(path: string): void {
136
+ const resolved = resolve(viewsDir, path);
137
+ if (resolved !== viewsDir && !resolved.startsWith(viewsDir + sep)) {
138
+ throw new Error('[[error:invalid-path]]');
139
+ }
140
+ }
141
+
135
142
  export async function editTemplate({
136
143
  path,
137
144
  diff,
138
145
  old,
139
146
  }: Template): Promise<void> {
147
+ assertPathWithinViews(path);
140
148
  await Promise.all([
141
149
  setObject<TemplateHash>(templateHashKey(path), {
142
150
  path,
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "nodebb-plugin-customize",
3
- "version": "5.0.0",
3
+ "version": "5.0.1",
4
4
  "description": "Customize NodeBB translations and templates",
5
5
  "main": "build/lib",
6
6
  "author": "Peter Jaszkowiak <p.jaszkow@gmail.com> (https://github.com/pitaj)",