[security] Use node path builtin for path resolution

[katanacrimson]

https://github.com/designcreateplay/NodeBB/blob/master/src/routes/user.js#L115

I smell security issues with this, probably directory traversal; probably in that you're only working with / and not \ too. Let path do the job it is made to do.

http://nodejs.org/api/path.html

Use path.normalize to prevent directory traversal, path.relative to change the path we're aimed towards...etc.

[barisusakli]

Changed to use path.basename.

https://github.com/designcreateplay/NodeBB/blob/master/src/routes/user.js#L116

[katanacrimson]

considering how filename is only used in one line in that scope, why not wrap the entire thing using path.join (for OS-relative paths)

e.g.

        var absolutePath = path.join([global.configuration['ROOT_DIRECTORY'], config.upload_path, path.basename(oldpicture)]);