fix: #9040

src/controllers/write/topics.js

@@ -115,6 +115,6 @@ Topics.addThumb = async (req, res) => {
 };
 
 Topics.deleteThumb = async (req, res) => {
-	await topics.thumbs.delete(req.params.tid, req.query.path);
+	await topics.thumbs.delete(req.params.tid, req.body.path);
 	helpers.formatApiResponse(200, res, await topics.thumbs.get(req.params.tid));
 };

src/middleware/assert.js

@@ -44,15 +44,6 @@ Assert.topic = helpers.try(async (req, res, next) => {
 	next();
 });
 
-Assert.topicThumb = helpers.try(async (req, res, next) => {
-	// thumbs are parsed out of req.query
-	if (!await topics.thumbs.exists(req.params.tid, req.query.path)) {
-		return controllerHelpers.formatApiResponse(404, res, new Error('[[error:invalid-file]]'));
-	}
-
-	next();
-});
-
 Assert.post = helpers.try(async (req, res, next) => {
 	if (!await posts.exists(req.params.pid)) {
 		return controllerHelpers.formatApiResponse(404, res, new Error('[[error:no-topic]]'));
@@ -67,7 +58,6 @@ Assert.path = helpers.try(async (req, res, next) => {
 		req.body.path = new URL(req.body.path).pathname;
 	}
 
-	// Checks file exists and is within bounds of upload_path
 	const pathToFile = path.join(nconf.get('upload_path'), req.body.path);
 	res.locals.cleanedPath = pathToFile;
 

src/routes/write/topics.js

@@ -35,7 +35,7 @@ module.exports = function () {
 	setupApiRoute(router, 'delete', '/:tid/tags', [...middlewares, middleware.assert.topic], controllers.write.topics.deleteTags);
 
 	setupApiRoute(router, 'post', '/:tid/thumbs', [multipartMiddleware, middleware.validateFiles, ...middlewares], controllers.write.topics.addThumb);
-	setupApiRoute(router, 'delete', '/:tid/thumbs', [...middlewares, middleware.assert.topic, middleware.assert.topicThumb], controllers.write.topics.deleteThumb);
+	setupApiRoute(router, 'delete', '/:tid/thumbs', [...middlewares, middleware.assert.topic, middleware.assert.path], controllers.write.topics.deleteThumb);
 
 	return router;
 };