fix sendFile path

revspace · May 20, 2024 · 6e013f9 · 6e013f9
1 parent 9e3dff3
commit 6e013f9
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/server/plugins/uploader.ts b/server/plugins/uploader.ts
@@ -148,7 +148,8 @@ class Uploader {
 		res.setHeader("Content-Disposition", disposition);
 		res.contentType(detectedMimeType);
 
-		return res.sendFile(filePath, {
+		// using unsafePath because it's safely resolved against 'root' by sendFile
+		return res.sendFile(unsafePath, {
 			root: uploadPath,
 			maxAge: 86400
 		});