4e4d3706 · permissionBRICK/SillyTavern

+        }
         // Create sprites folder if it doesn't exist
-        const spritesPath = path.join(directories.characters, name);
+        const spritesPath = getSpritesPath(directories, name, false);
+        // Invalid sprites path
+        if (!spritesPath) {
+            return;
+        }
+        // Create sprites folder if it doesn't exist
         if (!fs.existsSync(spritesPath)) {
-            fs.mkdirSync(spritesPath);
+            fs.mkdirSync(spritesPath, { recursive: true });
+        }
         // Path to sprites is not a directory. This should never happen.

@@ -94,7 +101,7 @@ export function importRisuSprites(directories, data) {
94	}	101	}
95		102
96	const filename = label + '.png';	103	const filename = label + '.png';
97	const pathToFile = path.join(spritesPath, filename);	104	const pathToFile = path.join(spritesPath, sanitize(filename));
98	writeFileAtomicSync(pathToFile, fileBase64, { encoding: 'base64' });	105	writeFileAtomicSync(pathToFile, fileBase64, { encoding: 'base64' });
99	}	106	}
100		107

 router.post('/delete', async (request, response) => {
     const label = request.body.label;
-    const name = request.body.name;
+    const name = String(request.body.name);
+    const isSubfolder = name.includes('/');
     const spriteName = request.body.spriteName || label;
     if (!spriteName || !name) {

@@ -153,10 +161,10 @@ router.post('/delete', async (request, response) => {
153	}	161	}
154		162
155	try {	163	try {
156	const spritesPath = path.join(request.user.directories.characters, name);	164	const spritesPath = getSpritesPath(request.user.directories, name, isSubfolder);
157		165
158	// No sprites folder exists, or not a directory	166	// No sprites folder exists, or not a directory
159	if (!fs.existsSync(spritesPath) \|\| !fs.statSync(spritesPath).isDirectory()) {	167	if (!spritesPath \|\| !fs.existsSync(spritesPath) \|\| !fs.statSync(spritesPath).isDirectory()) {
160	return response.sendStatus(404);	168	return response.sendStatus(404);
161	}	169	}
162		170

 router.post('/upload-zip', async (request, response) => {
     const file = request.file;
-    const name = request.body.name;
+    const name = String(request.body.name);
+    const isSubfolder = name.includes('/');
     if (!file || !name) {
         return response.sendStatus(400);
+    }
     try {
-        const spritesPath = path.join(request.user.directories.characters, name);
+        const spritesPath = getSpritesPath(request.user.directories, name, isSubfolder);
+        // Invalid sprites path
+        if (!spritesPath) {
+            return response.sendStatus(400);
+        }
         // Create sprites folder if it doesn't exist
         if (!fs.existsSync(spritesPath)) {
-            fs.mkdirSync(spritesPath);
+            fs.mkdirSync(spritesPath, { recursive: true });
+        }
         // Path to sprites is not a directory. This should never happen.

@@ -210,7 +224,7 @@ router.post('/upload-zip', async (request, response) => {
210	}	224	}
211		225
212	// Write sprite buffer to disk	226	// Write sprite buffer to disk
213	const pathToSprite = path.join(spritesPath, filename);	227	const pathToSprite = path.join(spritesPath, sanitize(filename));
214	writeFileAtomicSync(pathToSprite, buffer);	228	writeFileAtomicSync(pathToSprite, buffer);
215	}	229	}
216		230

 router.post('/upload', async (request, response) => {
     const file = request.file;
     const label = request.body.label;
-    const name = request.body.name;
+    const name = String(request.body.name);
+    const isSubfolder = name.includes('/');
     const spriteName = request.body.spriteName || label;
     if (!file || !label || !name) {

+    }
     try {
-        const spritesPath = path.join(request.user.directories.characters, name);
+        const spritesPath = getSpritesPath(request.user.directories, name, isSubfolder);
+        // Invalid sprites path
+        if (!spritesPath) {
+            return response.sendStatus(400);
+        }
         // Create sprites folder if it doesn't exist
         if (!fs.existsSync(spritesPath)) {
-            fs.mkdirSync(spritesPath);
+            fs.mkdirSync(spritesPath, { recursive: true });
+        }
         // Path to sprites is not a directory. This should never happen.

         const filename = spriteName + path.parse(file.originalname).ext;
         const spritePath = path.join(file.destination, file.filename);
-        const pathToFile = path.join(spritesPath, filename);
+        const pathToFile = path.join(spritesPath, sanitize(filename));
         // Copy uploaded file to sprites folder
         fs.cpSync(spritePath, pathToFile);
         // Remove uploaded file

Merge branch 'release' into staging