diff --git a/src/controllers/write/topics.js b/src/controllers/write/topics.js index e781948c0b..650c9eaa5f 100644 --- a/src/controllers/write/topics.js +++ b/src/controllers/write/topics.js @@ -115,6 +115,6 @@ Topics.addThumb = async (req, res) => { }; Topics.deleteThumb = async (req, res) => { - await topics.thumbs.delete(req.params.tid, req.query.path); + await topics.thumbs.delete(req.params.tid, req.body.path); helpers.formatApiResponse(200, res, await topics.thumbs.get(req.params.tid)); }; diff --git a/src/middleware/assert.js b/src/middleware/assert.js index a25eb933af..ce45e5d1c2 100644 --- a/src/middleware/assert.js +++ b/src/middleware/assert.js @@ -44,15 +44,6 @@ Assert.topic = helpers.try(async (req, res, next) => { next(); }); -Assert.topicThumb = helpers.try(async (req, res, next) => { - // thumbs are parsed out of req.query - if (!await topics.thumbs.exists(req.params.tid, req.query.path)) { - return controllerHelpers.formatApiResponse(404, res, new Error('[[error:invalid-file]]')); - } - - next(); -}); - Assert.post = helpers.try(async (req, res, next) => { if (!await posts.exists(req.params.pid)) { return controllerHelpers.formatApiResponse(404, res, new Error('[[error:no-topic]]')); @@ -67,7 +58,6 @@ Assert.path = helpers.try(async (req, res, next) => { req.body.path = new URL(req.body.path).pathname; } - // Checks file exists and is within bounds of upload_path const pathToFile = path.join(nconf.get('upload_path'), req.body.path); res.locals.cleanedPath = pathToFile; diff --git a/src/routes/write/topics.js b/src/routes/write/topics.js index a354dc1c23..c7feb4b318 100644 --- a/src/routes/write/topics.js +++ b/src/routes/write/topics.js @@ -35,7 +35,7 @@ module.exports = function () { setupApiRoute(router, 'delete', '/:tid/tags', [...middlewares, middleware.assert.topic], controllers.write.topics.deleteTags); setupApiRoute(router, 'post', '/:tid/thumbs', [multipartMiddleware, middleware.validateFiles, ...middlewares], controllers.write.topics.addThumb); - setupApiRoute(router, 'delete', '/:tid/thumbs', [...middlewares, middleware.assert.topic, middleware.assert.topicThumb], controllers.write.topics.deleteThumb); + setupApiRoute(router, 'delete', '/:tid/thumbs', [...middlewares, middleware.assert.topic, middleware.assert.path], controllers.write.topics.deleteThumb); return router; };