yusufipek/OpenFrame
1
0
Fork 0
mirror of https://github.com/yusufipk/OpenFrame.git synced 2026-09-11 09:36:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: address security vulnerabilities and add image attachments

Browse Source 
- Fix type confusion vulnerability in comment content updates
- Validate pagination offsets to prevent negative values
- Validate timestamp is a valid number before parsing
- Exclude guestEmail from comment API responses for privacy
- Fix TypeScript error in audio upload route
- Add image attachment support for comments with upload API
- Update admin dashboard to track image attachments
- Rename cleanup functions to handle both voice and image media
This commit is contained in:
Yusuf İpek
2026-02-21 16:40:58 +03:00
parent cd9b89c971
commit e32196c430
15 changed files with 837 additions and 119 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/admin-stats.ts
+29 -13
View File
@@ -34,10 +34,10 @@ export const getCachedTotalStorage = unstable_cache(
{ revalidate: 600 }
);
export const getCachedUserVoiceStorage = unstable_cache(
export const getCachedUserMediaStorage = unstable_cache(
async () => {
// Return a plain object so it maps cleanly out of unstable_cache across requests
const userStorage: Record<string, number> = {};
const userStorage: Record<string, { total: number, voice: number, image: number }> = {};
try {
const fileSizes = new Map<string, number>();
let isTruncated = true;
@@ -57,25 +57,41 @@ export const getCachedUserVoiceStorage = unstable_cache(
continuationToken = data.NextContinuationToken;
}
const voiceComments = await db.comment.findMany({
where: { voiceUrl: { not: null }, authorId: { not: null } },
select: { authorId: true, voiceUrl: true }
const mediaComments = await db.comment.findMany({
where: { OR: [{ voiceUrl: { not: null } }, { imageUrl: { not: null } }], authorId: { not: null } },
select: { authorId: true, voiceUrl: true, imageUrl: true }
});
for (const comment of voiceComments) {
if (!comment.authorId || !comment.voiceUrl) continue;
const keyParts = comment.voiceUrl.split('/');
const filename = keyParts[keyParts.length - 1];
const r2Key = `voice/${filename}`;
const size = fileSizes.get(r2Key) || 0;
for (const comment of mediaComments) {
if (!comment.authorId) continue;
userStorage[comment.authorId] = (userStorage[comment.authorId] || 0) + size;
if (!userStorage[comment.authorId]) {
userStorage[comment.authorId] = { total: 0, voice: 0, image: 0 };
}
if (comment.voiceUrl) {
const keyParts = comment.voiceUrl.split('/');
const filename = keyParts[keyParts.length - 1];
const r2Key = `voice/${filename}`;
const size = fileSizes.get(r2Key) || 0;
userStorage[comment.authorId].voice += size;
userStorage[comment.authorId].total += size;
}
if (comment.imageUrl) {
const keyParts = comment.imageUrl.split('/');
const filename = keyParts[keyParts.length - 1];
const r2Key = `images/${filename}`;
const size = fileSizes.get(r2Key) || 0;
userStorage[comment.authorId].image += size;
userStorage[comment.authorId].total += size;
}
}
} catch (err) {
console.error('Failed to parse user storage:', err);
}
return userStorage;
},
['admin-user-voice-storage'],
['admin-user-media-storage'],
{ revalidate: 600 }
);