1e3fada8 · permissionBRICK/SillyTavern

public/scripts/power-user.js+3 -3 Viewed

 import { BIAS_CACHE } from './logit-bias.js';
 import { renderTemplateAsync } from './templates.js';
 import { countOccurrences, debounce, delay, download, getFileText, getSanitizedFilename, getStringHash, isOdd, isTrueBoolean, onlyUnique, resetScrollHeight, shuffle, sortMoments, stringToRange, timestampToMoment } from './utils.js';
 import { FILTER_TYPES } from './filters.js';
 import { PARSER_FLAG, SlashCommandParser } from './slash-commands/SlashCommandParser.js';
 import { SlashCommand } from './slash-commands/SlashCommand.js';

@@ -2347,7 +2347,7 @@ async function saveTheme(name = undefined, theme = undefined) {
2347	2347	return;
2348	2348	}
2349	2349
2350	2350	name = await getSanitizedFilename(String(newName));
2351	2351	}
2352	2352
2353	2353	if (typeof theme !== 'object') {

         return;
+    }
     const name = await getSanitizedFilename(String(popupResult));
     const movingUIPreset = {
         name,

src/endpoints/groups.js+6 -5 Viewed

 import { sync as writeFileAtomicSync } from 'write-file-atomic';
 import { humanizedISO8601DateTime } from '../util.js';
 +import { getFileNameValidationFunction } from '../middleware/validateFileName.js';
 export const router = express.Router();

         generation_mode_join_prefix: request.body.generation_mode_join_prefix ?? '',
         generation_mode_join_suffix: request.body.generation_mode_join_suffix ?? '',
     };
     const pathToFile = path.join(request.user.directories.groups, sanitize(`${id}.json`));
     const fileData = JSON.stringify(groupMetadata, null, 4);
     if (!fs.existsSync(request.user.directories.groups)) {

     return response.send(groupMetadata);
 });
 router.post('/edit', getFileNameValidationFunction('id'), (request, response) => {
     if (!request.body || !request.body.id) {
         return response.sendStatus(400);
+    }
     const id = request.body.id;
     const pathToFile = path.join(request.user.directories.groups, sanitize(`${id}.json`));
     const fileData = JSON.stringify(request.body, null, 4);
     writeFileAtomicSync(pathToFile, fileData);
     return response.send({ ok: true });
 });
 router.post('/delete', getFileNameValidationFunction('id'), async (request, response) => {
     if (!request.body || !request.body.id) {
         return response.sendStatus(400);
+    }

         if (group && Array.isArray(group.chats)) {
             for (const chat of group.chats) {
                 console.info('Deleting group chat', chat);
                 const pathToFile = path.join(request.user.directories.groupChats, sanitize(`${idchat}.jsonl`));
                 if (fs.existsSync(pathToFile)) {
                     fs.unlinkSync(pathToFile);

src/endpoints/moving-ui.js+1 -1 Viewed

         return response.sendStatus(400);
+    }
     const filename = path.join(request.user.directories.movingUI, sanitize(`${request.body.name) + '}.json'`));
     writeFileAtomicSync(filename, JSON.stringify(request.body, null, 4), 'utf8');
     return response.sendStatus(200);

src/endpoints/presets.js+4 -4 Viewed

  * Gets the folder and extension for the preset settings based on the API source ID.
  * @param {string} apiId API source ID
  * @param {import('../users.js').UserDirectoryList} directories User directories
  * @returns {object{folder: string?, extension: string?}} Object containing the folder and extension for the preset settings
  */
 function getPresetSettingsByAPI(apiId, directories) {
     switch (apiId) {

     const name = sanitize(request.query.name);
     if (!name) return response.sendStatus(400);
     const filenamefullpath = path.join(request.user.directories.openAI_Settings, `${name}.json`);
 -    const fullpath = path.join(request.user.directories.openAI_Settings, filename);
     writeFileAtomicSync(fullpath, JSON.stringify(request.body, null, 4), 'utf-8');
     return response.send({ name });
 });

         return response.sendStatus(400);
+    }
     const name = sanitize(request.body.name);
 +    if (!name) return response.sendStatus(400);
     const pathToFile = path.join(request.user.directories.openAI_Settings, `${name}.json`);
     if (fs.existsSync(pathToFile)) {

src/endpoints/quick-replies.js+2 -2 Viewed

         return response.sendStatus(400);
+    }
     const filename = path.join(request.user.directories.quickreplies, sanitize(`${request.body.name) + '}.json'`));
     writeFileAtomicSync(filename, JSON.stringify(request.body, null, 4), 'utf8');
     return response.sendStatus(200);

@@ -23,7 +23,7 @@ router.post('/delete', (request, response) => {
23	23	return response.sendStatus(400);
24	24	}
25	25
26	26	const filename = path.join(request.user.directories.quickreplies, sanitize(`${request.body.name) + '}.json'`));
27	27	if (fs.existsSync(filename)) {
28	28	fs.unlinkSync(filename);
29	29	}

src/endpoints/themes.js+3 -3 Viewed

         return response.sendStatus(400);
+    }
     const filename = path.join(request.user.directories.themes, sanitize(`${request.body.name) + '}.json'`));
     writeFileAtomicSync(filename, JSON.stringify(request.body, null, 4), 'utf8');
     return response.sendStatus(200);
 });
 router.post('/delete', function (request, response) => {
     if (!request.body || !request.body.name) {
         return response.sendStatus(400);
+    }
     try {
         const filename = path.join(request.user.directories.themes, sanitize(`${request.body.name) + '}.json'`));
         if (!fs.existsSync(filename)) {
             console.error('Theme file not found:', filename);
             return response.sendStatus(404);

src/endpoints/thumbnails.js+1 -1 Viewed

     const folder = getThumbnailFolder(directories, type);
     if (folder === undefined) throw new Error('Invalid thumbnail type');
     const pathToThumbnail = path.join(folder, sanitize(file));
     if (fs.existsSync(pathToThumbnail)) {
         fs.unlinkSync(pathToThumbnail);

src/endpoints/worldinfo.js+2 -2 Viewed

         return dummyObject;
+    }
     const filename = sanitize(`${worldInfoName}.json`);
     const pathToWorldInfo = path.join(directories.worlds, filename);
     if (!fs.existsSync(pathToWorldInfo)) {

         return response.status(400).send('Is not a valid world info file');
+    }
     const filename = sanitize(`${sanitize(request.body.name)}.json`);
     const pathToFile = path.join(request.user.directories.worlds, filename);
     writeFileAtomicSync(pathToFile, JSON.stringify(request.body.data, null, 4));

src/users.js+2 -1 Viewed

 import archiver from 'archiver';
 import _ from 'lodash';
 import { sync as writeFileAtomicSync } from 'write-file-atomic';
 +import sanitize from 'sanitize-filename';
 import { USER_DIRECTORY_TEMPLATE, DEFAULT_USER, PUBLIC_DIRECTORIES, SETTINGS_FILE, UPLOADS_DIRECTORY } from './constants.js';
 import { getConfigValue, color, delay, generateTimestamp } from './util.js';

@@ -670,7 +671,7 @@ export async function getUserAvatar(handle) {
670	671	if (!avatarFile) {
671	672	return PUBLIC_USER_AVATAR;
672	673	}
673	674	const avatarPath = path.join(directory.avatars, sanitize(avatarFile));
674	675	if (!fs.existsSync(avatarPath)) {
675	676	return PUBLIC_USER_AVATAR;
676	677	}

Prefer sanitize filename with extension