add user banners :)
This commit is contained in:
255
src/banner_handler.mjs
Normal file
255
src/banner_handler.mjs
Normal file
@@ -0,0 +1,255 @@
|
||||
import cfg from "./inc/config.mjs";
|
||||
import path from "path";
|
||||
import { promises as fs } from "fs";
|
||||
import db from "./inc/sql.mjs";
|
||||
import lib from "./inc/lib.mjs";
|
||||
import { parseMultipart, collectBody } from "./inc/multipart.mjs";
|
||||
import { execFile as _execFile } from "child_process";
|
||||
import { promisify } from "util";
|
||||
|
||||
const execFile = promisify(_execFile);
|
||||
|
||||
// Helper for JSON response
|
||||
const sendJson = (res, data, code = 200) => {
|
||||
res.writeHead(code, { 'Content-Type': 'application/json' });
|
||||
res.end(JSON.stringify(data));
|
||||
};
|
||||
|
||||
// Generate UUID using the same method as video uploads
|
||||
const genuuid = async () => {
|
||||
const raw = (await db`select replace(gen_random_uuid()::text, '-', '') || replace(gen_random_uuid()::text, '-', '') as uuid`)[0].uuid;
|
||||
return raw.substring(0, 48);
|
||||
};
|
||||
|
||||
export const handleBannerUpload = async (req, res) => {
|
||||
console.log('[BANNER HANDLER] Upload started');
|
||||
|
||||
// Manual Session Lookup
|
||||
let user = [];
|
||||
if (req.cookies && req.cookies.session) {
|
||||
user = await db`
|
||||
select "user".id, "user".login, "user".user, "user".admin, "user_sessions".id as sess_id, "user_sessions".csrf_token, "user_options".*
|
||||
from "user_sessions"
|
||||
left join "user" on "user".id = "user_sessions".user_id
|
||||
left join "user_options" on "user_options".user_id = "user_sessions".user_id
|
||||
where "user_sessions".session = ${lib.sha256(req.cookies.session)}
|
||||
limit 1
|
||||
`;
|
||||
}
|
||||
|
||||
if (user.length === 0) {
|
||||
console.log('[BANNER HANDLER] Unauthorized - No valid session found');
|
||||
return sendJson(res, { success: false, msg: 'Unauthorized' }, 401);
|
||||
}
|
||||
|
||||
req.session = user[0];
|
||||
console.log('[BANNER HANDLER] Authorized:', req.session.user);
|
||||
|
||||
// CSRF validation
|
||||
if (req.session.csrf_token) {
|
||||
const csrfToken = req.headers['x-csrf-token'];
|
||||
if (!csrfToken || csrfToken !== req.session.csrf_token) {
|
||||
console.warn(`[CSRF] Blocked banner upload for user ${req.session.user}. Invalid token.`);
|
||||
return sendJson(res, { success: false, msg: 'Invalid CSRF token' }, 403);
|
||||
}
|
||||
}
|
||||
|
||||
try {
|
||||
const contentType = req.headers['content-type'] || '';
|
||||
const boundaryMatch = contentType.match(/boundary=(.+)$/);
|
||||
|
||||
if (!boundaryMatch) {
|
||||
console.log('[BANNER HANDLER] No boundary');
|
||||
return sendJson(res, { success: false, msg: 'Invalid content type' }, 400);
|
||||
}
|
||||
|
||||
console.log('[BANNER HANDLER] Collecting body...');
|
||||
const body = await collectBody(req);
|
||||
console.log('[BANNER HANDLER] Body collected, size:', body.length);
|
||||
|
||||
console.log('[BANNER HANDLER] Parsing multipart...');
|
||||
const parts = parseMultipart(body, boundaryMatch[1]);
|
||||
const file = parts.file;
|
||||
console.log('[BANNER HANDLER] Parsed, file present:', !!file, 'keys:', Object.keys(parts));
|
||||
|
||||
if (!file || !file.data) {
|
||||
return sendJson(res, { success: false, msg: 'No file provided' }, 400);
|
||||
}
|
||||
|
||||
// Validate file size (5MB max)
|
||||
const maxSize = 5 * 1024 * 1024;
|
||||
if (file.data.length > maxSize) {
|
||||
return sendJson(res, {
|
||||
success: false,
|
||||
msg: `File too large. Maximum size is 5MB, got ${(file.data.length / 1024 / 1024).toFixed(2)}MB`
|
||||
}, 400);
|
||||
}
|
||||
|
||||
// Allowed MIME types
|
||||
const allowedMimes = [
|
||||
'image/gif',
|
||||
'image/jpeg',
|
||||
'image/jpg',
|
||||
'image/png',
|
||||
'image/webp'
|
||||
];
|
||||
|
||||
// Validate MIME type from content-type header
|
||||
let mime = (file.contentType || '').toLowerCase().split(';')[0].trim();
|
||||
console.log('[BANNER HANDLER] File MIME from header:', mime);
|
||||
if (!allowedMimes.includes(mime)) {
|
||||
return sendJson(res, {
|
||||
success: false,
|
||||
msg: `Invalid file type. Allowed: gif, jpg, jpeg, png, webp. Got: ${mime}`
|
||||
}, 400);
|
||||
}
|
||||
|
||||
// Save to tmp and verify with file magic
|
||||
console.log('[BANNER HANDLER] Generating UUID...');
|
||||
const uuid = await genuuid();
|
||||
const tmpPath = path.join(cfg.paths.tmp, `banner_${uuid}_tmp`);
|
||||
const finalFilename = `banner_${uuid}.webp`;
|
||||
const finalPath = path.join(cfg.paths.a, finalFilename);
|
||||
|
||||
await fs.mkdir(cfg.paths.tmp, { recursive: true });
|
||||
await fs.mkdir(cfg.paths.a, { recursive: true });
|
||||
|
||||
console.log('[BANNER HANDLER] Writing tmp file:', tmpPath);
|
||||
await fs.writeFile(tmpPath, file.data);
|
||||
|
||||
// Verify MIME with file magic
|
||||
console.log('[BANNER HANDLER] Checking MIME with file magic...');
|
||||
const { stdout: actualMime } = await execFile('file', ['--mime-type', '-b', tmpPath]);
|
||||
console.log('[BANNER HANDLER] Actual MIME:', actualMime.trim());
|
||||
const allowedActualMimes = [
|
||||
'image/gif',
|
||||
'image/jpeg',
|
||||
'image/png',
|
||||
'image/webp'
|
||||
];
|
||||
|
||||
if (!allowedActualMimes.includes(actualMime.trim())) {
|
||||
await fs.unlink(tmpPath).catch(() => { });
|
||||
return sendJson(res, {
|
||||
success: false,
|
||||
msg: `Invalid file type detected: ${actualMime.trim()}`
|
||||
}, 400);
|
||||
}
|
||||
|
||||
// Convert to webp using ImageMagick — landscape banner crop (1200x400)
|
||||
// NOTE: [0] frame selector must be appended to the input path, not a separate arg
|
||||
console.log('[BANNER HANDLER] Running magick...');
|
||||
try {
|
||||
await execFile('magick', [`${tmpPath}[0]`, '-resize', '1200x400^', '-gravity', 'center', '-background', 'none', '-extent', '1200x400', '-quality', '75', finalPath]);
|
||||
} catch (err) {
|
||||
console.error('[BANNER HANDLER] Magick error:', err.message, err.stderr);
|
||||
await fs.unlink(tmpPath).catch(() => { });
|
||||
return sendJson(res, { success: false, msg: 'Failed to process image: ' + err.message }, 500);
|
||||
}
|
||||
console.log('[BANNER HANDLER] Magick done, output:', finalPath);
|
||||
|
||||
// Get current banner_file to delete old one (after magick succeeds)
|
||||
let currentBanner = null;
|
||||
try {
|
||||
currentBanner = (await db`
|
||||
select banner_file from user_options where user_id = ${+req.session.id}
|
||||
`)[0]?.banner_file;
|
||||
} catch (dbErr) {
|
||||
console.error('[BANNER HANDLER] Could not fetch current banner (column may not exist yet):', dbErr.message);
|
||||
}
|
||||
|
||||
// Clean up tmp file
|
||||
await fs.unlink(tmpPath).catch(() => { });
|
||||
|
||||
// Delete old banner file if exists
|
||||
if (currentBanner) {
|
||||
const oldPath = path.join(cfg.paths.a, currentBanner);
|
||||
await fs.unlink(oldPath).catch(() => { });
|
||||
}
|
||||
|
||||
// Update database
|
||||
console.log('[BANNER HANDLER] Updating database...');
|
||||
try {
|
||||
await db`
|
||||
update user_options
|
||||
set banner_file = ${finalFilename}
|
||||
where user_id = ${+req.session.id}
|
||||
`;
|
||||
} catch (dbErr) {
|
||||
console.error('[BANNER HANDLER] DB update failed:', dbErr.message);
|
||||
await fs.unlink(finalPath).catch(() => {});
|
||||
return sendJson(res, { success: false, msg: 'DB error — did you run the migration? ' + dbErr.message }, 500);
|
||||
}
|
||||
|
||||
console.log('[BANNER HANDLER] Upload complete:', finalFilename);
|
||||
return sendJson(res, {
|
||||
success: true,
|
||||
banner_file: finalFilename,
|
||||
msg: 'Banner uploaded successfully'
|
||||
}, 200);
|
||||
|
||||
} catch (err) {
|
||||
if (err.code === 'BODY_TOO_LARGE') {
|
||||
return sendJson(res, { success: false, msg: 'File too large (5 MB max for banners)' }, 413);
|
||||
}
|
||||
console.error('[BANNER HANDLER ERROR]', err.message, err.stack);
|
||||
try {
|
||||
return sendJson(res, { success: false, msg: err.message || 'Banner upload failed' }, 500);
|
||||
} catch (_) {}
|
||||
}
|
||||
};
|
||||
|
||||
export const handleBannerDelete = async (req, res) => {
|
||||
console.log('[BANNER HANDLER] Delete started');
|
||||
|
||||
// Manual Session Lookup
|
||||
let user = [];
|
||||
if (req.cookies && req.cookies.session) {
|
||||
user = await db`
|
||||
select "user".id, "user".login, "user".user, "user".admin, "user_sessions".id as sess_id, "user_sessions".csrf_token, "user_options".*
|
||||
from "user_sessions"
|
||||
left join "user" on "user".id = "user_sessions".user_id
|
||||
left join "user_options" on "user_options".user_id = "user_sessions".user_id
|
||||
where "user_sessions".session = ${lib.sha256(req.cookies.session)}
|
||||
limit 1
|
||||
`;
|
||||
}
|
||||
|
||||
if (user.length === 0) {
|
||||
return sendJson(res, { success: false, msg: 'Unauthorized' }, 401);
|
||||
}
|
||||
|
||||
req.session = user[0];
|
||||
|
||||
// CSRF validation
|
||||
if (req.session.csrf_token) {
|
||||
const csrfToken = req.headers['x-csrf-token'];
|
||||
if (!csrfToken || csrfToken !== req.session.csrf_token) {
|
||||
console.warn(`[CSRF] Blocked banner delete for user ${req.session.user}. Invalid token.`);
|
||||
return sendJson(res, { success: false, msg: 'Invalid CSRF token' }, 403);
|
||||
}
|
||||
}
|
||||
|
||||
try {
|
||||
const currentBanner = (await db`
|
||||
select banner_file from user_options where user_id = ${+req.session.id}
|
||||
`)[0]?.banner_file;
|
||||
|
||||
if (currentBanner) {
|
||||
const oldPath = path.join(cfg.paths.a, currentBanner);
|
||||
await fs.unlink(oldPath).catch(() => { });
|
||||
}
|
||||
|
||||
await db`
|
||||
update user_options
|
||||
set banner_file = null
|
||||
where user_id = ${+req.session.id}
|
||||
`;
|
||||
|
||||
console.log('[BANNER HANDLER] Delete complete');
|
||||
return sendJson(res, { success: true, msg: 'Custom banner removed' }, 200);
|
||||
} catch (err) {
|
||||
console.error('[BANNER DELETE ERROR]', err);
|
||||
return sendJson(res, { success: false, msg: 'Failed to remove banner' }, 500);
|
||||
}
|
||||
};
|
||||
@@ -534,6 +534,7 @@ export default {
|
||||
uo.display_name as author_display_name,
|
||||
uo.avatar as author_avatar,
|
||||
uo.avatar_file as author_avatar_file,
|
||||
uo.banner_file as author_banner_file,
|
||||
uo.description as author_description,
|
||||
author_u.id as author_id,
|
||||
items.is_pinned,
|
||||
@@ -794,6 +795,7 @@ export default {
|
||||
author_display_name: actitem.author_display_name || null,
|
||||
author_avatar: actitem.author_avatar,
|
||||
author_avatar_file: actitem.author_avatar_file,
|
||||
author_banner_file: actitem.author_banner_file,
|
||||
author_description: actitem.author_description,
|
||||
title: actitem.title || null,
|
||||
|
||||
|
||||
@@ -23,9 +23,9 @@ export default (router, tpl) => {
|
||||
join tags t on t.id = et.id
|
||||
`;
|
||||
|
||||
// Get custom avatar file if exists
|
||||
// Get custom avatar file and banner file if exists
|
||||
const userOptions = (await db`
|
||||
select avatar_file from user_options where user_id = ${+req.session.id}
|
||||
select avatar_file, banner_file from user_options where user_id = ${+req.session.id}
|
||||
`)[0];
|
||||
|
||||
// Get full user info
|
||||
@@ -46,8 +46,10 @@ export default (router, tpl) => {
|
||||
sessions,
|
||||
excluded_tags: excluded_tags || [],
|
||||
avatar_file: userOptions?.avatar_file || null,
|
||||
banner_file: userOptions?.banner_file || null,
|
||||
email: user?.email || '',
|
||||
joined: user?.created_at || null,
|
||||
user_banner_enabled: cfg.websrv.user_banner_enabled !== false,
|
||||
enable_swf: cfg.enable_swf,
|
||||
enable_data_export: cfg.websrv.enable_data_export,
|
||||
enable_user_api_keys: cfg.websrv.enable_user_api_keys !== false,
|
||||
|
||||
@@ -10,6 +10,7 @@ import { getAboutText, setAboutText, getRulesText, setRulesText, getTermsText, s
|
||||
import flummpress from "flummpress";
|
||||
import { handleUpload } from "./upload_handler.mjs";
|
||||
import { handleAvatarUpload, handleAvatarDelete } from "./avatar_handler.mjs";
|
||||
import { handleBannerUpload, handleBannerDelete } from "./banner_handler.mjs";
|
||||
import { handleRethumbUpload } from "./rethumb_handler.mjs";
|
||||
import { handleMemeUpload, handleMemeEdit } from "./meme_upload_handler.mjs";
|
||||
import { handleEmojiUpload, handleEmojiEdit } from "./emoji_upload_handler.mjs";
|
||||
@@ -785,7 +786,7 @@ process.on('uncaughtException', err => {
|
||||
// because the session middleware will have completed by the time router callbacks execute.
|
||||
app.use(async (req, res) => {
|
||||
if (['GET', 'HEAD', 'OPTIONS'].includes(req.method)) return;
|
||||
if (['/login', '/register', '/api/v2/upload', '/api/v2/settings/uploadAvatar', '/api/v2/admin/memes', '/api/v2/admin/emojis', '/api/v2/meta/extract-file', '/api/v2/meta/strip-gps', '/api/v2/scroller/external/rehost-meta', '/api/v2/comments/upload', '/api/v2/admin/sticker-packs/import'].includes(req.url.pathname)) return;
|
||||
if (['/login', '/register', '/api/v2/upload', '/api/v2/settings/uploadAvatar', '/api/v2/settings/uploadBanner', '/api/v2/admin/memes', '/api/v2/admin/emojis', '/api/v2/meta/extract-file', '/api/v2/meta/strip-gps', '/api/v2/scroller/external/rehost-meta', '/api/v2/comments/upload', '/api/v2/admin/sticker-packs/import'].includes(req.url.pathname)) return;
|
||||
// DM attachment upload validates CSRF internally
|
||||
if (req.url.pathname.match(/^\/api\/dm\/attachment\/upload\//)) return;
|
||||
// Hall manager routes are handled by bypass middleware with their own session auth
|
||||
@@ -830,6 +831,23 @@ process.on('uncaughtException', err => {
|
||||
}
|
||||
});
|
||||
|
||||
// Bypass middleware for banner upload (needs raw body before router consumes it)
|
||||
// CSRF is validated inside handleBannerUpload/handleBannerDelete after their own session lookups
|
||||
app.use(async (req, res) => {
|
||||
if (req.url.pathname === '/api/v2/settings/uploadBanner') {
|
||||
if (cfg.websrv.user_banner_enabled === false) {
|
||||
return res.reply({ success: false, msg: 'Banner feature is currently disabled' }, 403);
|
||||
}
|
||||
if (req.method === 'POST') {
|
||||
await handleBannerUpload(req, res);
|
||||
req.url.pathname = '/handled_banner_upload_bypass';
|
||||
} else if (req.method === 'DELETE') {
|
||||
await handleBannerDelete(req, res);
|
||||
req.url.pathname = '/handled_banner_delete_bypass';
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
// Bypass middleware for custom thumbnail uploads
|
||||
app.use(async (req, res) => {
|
||||
const thumbMatch = req.url.pathname.match(/^\/api\/v2\/items\/([^/]+)\/thumbnail$/);
|
||||
@@ -1343,6 +1361,7 @@ process.on('uncaughtException', err => {
|
||||
lang: perRequestLang,
|
||||
user_alternative_infobox: useAltInfobox,
|
||||
user_alternative_steuerung: useAltSteuerung,
|
||||
user_banner_enabled: cfg.websrv.user_banner_enabled !== false,
|
||||
comment_display_mode: (req && req.session && typeof req.session.comment_display_mode === 'number')
|
||||
? req.session.comment_display_mode
|
||||
: (data && typeof data.comment_display_mode === 'number'
|
||||
|
||||
Reference in New Issue
Block a user