cpvalente/ontime
1
0
Fork 0
mirror of https://github.com/cpvalente/ontime.git synced 2026-08-07 00:13:53 +00:00
Code Issues Packages Projects Releases 10 Wiki Activity

fix: ensure filename sanitation in all routes

Browse Source
This commit is contained in:
Carlos Valente
2025-08-15 20:16:50 +02:00
committed by Carlos Valente
parent 0e770655dc
commit 902edf4a85
2 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/server/src/api-data/db/db.controller.ts
+3 -1
View File
@@ -8,6 +8,7 @@ import {
import { getErrorMessage } from 'ontime-utils';
import type { Request, Response } from 'express';
import sanitize from 'sanitize-filename';
import {
doesProjectExist,
@@ -74,7 +75,8 @@ export async function createProjectFile(req: Request, res: Response<{ filename:
*/
export async function quickProjectFile(req: Request, res: Response<{ filename: string } | ErrorResponse>) {
try {
const filename = await projectService.createProject(req.body.project.title || 'untitled', req.body);
const nameFromTitle = req.body.project.title ? sanitize(req.body.project.title) : 'untitled';
const filename = await projectService.createProject(nameFromTitle, req.body);
res.status(200).send({
filename,
});