Feature/budget template doc on plan page #431
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…it at plan details
…ix publishAsConcept
Badmuts
approved these changes
Sep 13, 2023
| ideaBudgets.splice(indexToDelete, 1); | ||
| } | ||
|
|
||
| console.log(JSON.stringify({ |
| const promises = []; | ||
| req.files.forEach((file, i) => { | ||
| const attachmentsPath = 'public/uploads/attachments/resource-form-uploads/' + req.body.resourceId; | ||
| const path = `${attachmentsPath}/${file.originalname}`; |
There was a problem hiding this comment.
Original filename moet hier eigenlijk een random string zijn. Dit omdat elke gebruiker die inloggen kan een bestand kan uploaden hier naar toe. Als een hacker dit filepath dus kan raden en evt toegang krijgt via een andere exploit om een bestand uit te voeren op de server kan deze dus een bestand uploaden via dit formulier dat code uitvoert. De hacker weet dan precies waar dit bestand leeft op de disk en kan deze dan dus uitvoeren.
Gezien er verder ook geen checks worden gedaan op het type bestand (https://github.com/sindresorhus/file-type) kan dus alles worden geupload.
packages/cms/lib/modules/resource-form-widgets/public/js/main.js
Outdated
Show resolved
Hide resolved
| const indexToDelete = ideaBudgets.findIndex(d =>{ | ||
| return d.name === data.name}); | ||
|
|
||
| if(indexToDelete > -1) { |
There was a problem hiding this comment.
Code om file te verwijderen van disk
Badmuts
approved these changes
Sep 13, 2023
Badmuts
approved these changes
Sep 14, 2023
packages/cms/lib/modules/resource-form-widgets/public/js/main.js
Outdated
Show resolved
Hide resolved
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Please include
Issue reference
Fixes # (issue)
Type of change
Is it a new feature, bug fix, code improvement, etc.
If it is a breaking change what needs to be done to fix that
Documentation
Is the documentation updated, maybe a link
Tests
(How) has the change been tested
Branch
If the branch to merge to is not development