dynamic köpfe

src/koepfe_handler.mjs

@@ -0,0 +1,92 @@
+import fs from 'fs/promises';
+import path from 'path';
+import crypto from 'crypto';
+import lib from './inc/lib.mjs';
+import cfg from './inc/config.mjs';
+
+function parseMultipart(req) {
+    return new Promise((resolve, reject) => {
+        let body = [];
+        req.on('data', chunk => body.push(chunk));
+        req.on('end', () => {
+            const buffer = Buffer.concat(body);
+            const boundaryMatch = req.headers['content-type']?.match(/boundary=(.+)$/i);
+            if (!boundaryMatch) return reject(new Error('No boundary'));
+            const boundary = '--' + boundaryMatch[1];
+            let start = buffer.indexOf(boundary) + boundary.length + 2;
+            let fileData = null;
+            let filename = null;
+            let csrfToken = null;
+            
+            while (start < buffer.length) {
+                const headerEnd = buffer.indexOf('\r\n\r\n', start);
+                if (headerEnd === -1) break;
+                const headerStr = buffer.slice(start, headerEnd).toString();
+                const nextBoundary = buffer.indexOf(boundary, headerEnd);
+                if (nextBoundary === -1) break;
+                const chunkData = buffer.slice(headerEnd + 4, nextBoundary - 2);
+
+                if (headerStr.includes('name="file"')) {
+                    const fnMatch = headerStr.match(/filename="(.+?)"/);
+                    if (fnMatch) filename = fnMatch[1];
+                    fileData = chunkData;
+                } else if (headerStr.includes('name="csrf_token"')) {
+                    csrfToken = chunkData.toString();
+                }
+                start = nextBoundary + boundary.length + 2;
+            }
+            resolve({ fileData, filename, csrfToken });
+        });
+        req.on('error', reject);
+    });
+}
+
+import db from './inc/sql.mjs';
+
+export async function handleKoepfeUpload(req, res) {
+    // Manual Session Lookup since this is a bypass middleware
+    let user = [];
+    if (req.cookies && req.cookies.session) {
+        user = await db`
+            select "user".id, "user".login, "user".user, "user".admin, "user_sessions".csrf_token
+            from "user_sessions"
+            left join "user" on "user".id = "user_sessions".user_id
+            where "user_sessions".session = ${lib.sha256(req.cookies.session)}
+            limit 1
+          `;
+    }
+
+    if (user.length === 0 || !user[0].admin) {
+        return res.reply ? res.reply({ code: 403, body: JSON.stringify({ success: false, msg: 'Forbidden' }) }) : res.writeHead(403, { 'Content-Type': 'application/json' }).end(JSON.stringify({ success: false, msg: 'Forbidden' }));
+    }
+    
+    req.session = user[0];
+    
+    try {
+        const { fileData, filename, csrfToken } = await parseMultipart(req);
+        
+        if (!req.session.csrf_token || csrfToken !== req.session.csrf_token) {
+             return res.writeHead(403, { 'Content-Type': 'application/json' }).end(JSON.stringify({ success: false, msg: 'Invalid CSRF' }));
+        }
+
+        if (!fileData || fileData.length === 0) {
+            throw new Error('No file data');
+        }
+
+        const ext = path.extname(filename || '.png').toLowerCase();
+        if (!['.png', '.jpg', '.jpeg', '.gif', '.webp', '.avif'].includes(ext)) {
+            throw new Error('Unsupported format');
+        }
+
+        const newName = crypto.randomBytes(8).toString('hex') + ext;
+        const targetPath = path.join(cfg.paths.koepfe, newName);
+
+        await fs.writeFile(targetPath, fileData);
+
+        return res.writeHead(200, { 'Content-Type': 'application/json' }).end(JSON.stringify({ success: true, file: '/s/koepfe/' + newName }));
+
+    } catch (e) {
+        console.error(e);
+        return res.writeHead(500, { 'Content-Type': 'application/json' }).end(JSON.stringify({ success: false, msg: e.message }));
+    }
+}