fix(assets): security fix

polonel · Oct 17, 2018 · b081965 · b081965
1 parent 7d71135
commit b081965
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 3 deletions.
diff --git a/src/middleware/index.js b/src/middleware/index.js
@@ -98,9 +98,8 @@ module.exports = function(app, db, callback) {
             //Mobile
             app.use('/mobile', express.static(path.join(__dirname, '../../', 'mobile')));
 
-            app.use('/uploads/tickets', middleware.redirectToLogin, express.static(path.resolve(__dirname, '/public/uploads/tickets')));
-            app.use('/uploads/users', middleware.redirectToLogin, express.static(path.resolve(__dirname, '/public/uploads/users')));
-
+            app.use('/uploads', middleware.redirectToLogin, express.static(path.resolve(__dirname, '/public/uploads')));
+
             app.use(express.static(path.join(__dirname, '../../', 'public')));
 
             //Remove to enable plugins

diff --git a/src/webserver.js b/src/webserver.js
@@ -96,6 +96,9 @@ var async   = require('async'),
         app.set('view engine', 'hbs');
         hbsHelpers.register(hbs.handlebars);
 
+        // Prevent unauth from uploads
+        app.use('/uploads', middleware.redirectToLogin, express.static(path.resolve(__dirname, '/public/uploads')));
+
         app.use(express.static(path.join(__dirname, '../', 'public')));
         app.use(favicon(path.join(__dirname, '../', 'public/img/favicon.ico')));
         app.use(bodyParser.urlencoded({ extended: false }));