closes #4325

src/controllers/uploads.js

@@ -60,7 +60,7 @@ uploadsController.uploadThumb = function(req, res, next) {
 	}
 
 	uploadsController.upload(req, res, function(uploadedFile, next) {
-		file.isFileTypeAllowed(uploadedFile.path, function(err, tempPath) {
+		file.isFileTypeAllowed(uploadedFile.path, function(err) {
 			if (err) {
 				return next(err);
 			}
@@ -94,7 +94,12 @@ uploadsController.uploadGroupCover = function(uid, uploadedFile, callback) {
 		return plugins.fireHook('filter:uploadFile', {file: uploadedFile, uid: uid}, callback);
 	}
 
-	saveFileToLocal(uploadedFile, callback);
+	file.isFileTypeAllowed(uploadedFile.path, function(err) {
+		if (err) {
+			return callback(err);
+		}
+		saveFileToLocal(uploadedFile, callback);
+	});
 };
 
 function uploadImage(uid, image, callback) {
@@ -102,7 +107,7 @@ function uploadImage(uid, image, callback) {
 		return plugins.fireHook('filter:uploadImage', {image: image, uid: uid}, callback);
 	}
 
-	file.isFileTypeAllowed(image.path, function(err, tempPath) {
+	file.isFileTypeAllowed(image.path, function(err) {
 		if (err) {
 			return callback(err);
 		}

src/file.js

@@ -52,7 +52,7 @@ file.base64ToLocal = function(imageData, uploadPath, callback) {
 file.isFileTypeAllowed = function(path, callback) {
 	// Attempt to read the file, if it passes, file type is allowed
 	jimp.read(path, function(err) {
-		callback(err, path);
+		callback(err);
 	});
 };
 

src/groups/cover.js

@@ -7,7 +7,6 @@ var fs = require('fs');
 var crypto = require('crypto');
 var Jimp = require('jimp');
 
-
 var db = require('../database');
 var file = require('../file');
 var uploadsController = require('../controllers/uploads');
@@ -39,11 +38,7 @@ module.exports = function(Groups) {
 				writeImageDataToFile(data.imageData, next);
 			},
 			function (_tempPath, next) {
-				tempPath = _tempPath;	// set in local var so it can be deleted if file type invalid
-				next(null, tempPath);
-			},
-			async.apply(file.isFileTypeAllowed),
-			function (_tempPath, next) {
+				tempPath = _tempPath;
 				uploadsController.uploadGroupCover(uid, {
 					name: 'groupCover',
 					path: tempPath

src/user/picture.js

@@ -37,39 +37,39 @@ module.exports = function(User) {
 			function(next) {
 				next(!extension ? new Error('[[error:invalid-image-extension]]') : null);
 			},
-			function(next) {
-				file.isFileTypeAllowed(picture.path, next);
-			},
-			function(path, next) {
-				image.resizeImage({
-					path: picture.path,
-					extension: extension,
-					width: imageDimension,
-					height: imageDimension
-				}, next);
-			},
-			function(next) {
-				if (convertToPNG) {
-					image.normalise(picture.path, extension, next);
-				} else {
-					next();
-				}
-			},
 			function(next) {
 				if (plugins.hasListeners('filter:uploadImage')) {
 					return plugins.fireHook('filter:uploadImage', {image: picture, uid: updateUid}, next);
 				}
 
 				var filename = updateUid + '-profileimg' + (convertToPNG ? '.png' : extension);
-				
+
 				async.waterfall([
+					function(next) {
+						file.isFileTypeAllowed(picture.path, next);
+					},
+					function(next) {
+						image.resizeImage({
+							path: picture.path,
+							extension: extension,
+							width: imageDimension,
+							height: imageDimension
+						}, next);
+					},
+					function(next) {
+						if (convertToPNG) {
+							image.normalise(picture.path, extension, next);
+						} else {
+							next();
+						}
+					},
 					function(next) {
 						User.getUserField(updateUid, 'uploadedpicture', next);
 					},
 					function(oldpicture, next) {
 						if (!oldpicture) {
 							return file.saveFileToLocal(filename, 'profile', picture.path, next);
-						}		
+						}
 						var oldpicturePath = path.join(nconf.get('base_dir'), nconf.get('upload_path'), 'profile', path.basename(oldpicture));
 
 						fs.unlink(oldpicturePath, function (err) {
@@ -79,7 +79,7 @@ module.exports = function(User) {
 
 							file.saveFileToLocal(filename, 'profile', picture.path, next);
 						});
-					},					
+					},
 				], next);
 			},
 			function(_image, next) {
@@ -167,12 +167,9 @@ module.exports = function(User) {
 				}, next);
 			},
 			function(next) {
-				file.isFileTypeAllowed(data.file.path, next);
-			},
-			function(tempPath, next) {
 				var image = {
 					name: 'profileCover',
-					path: tempPath,
+					path: data.file.path,
 					uid: data.uid
 				};
 
@@ -181,16 +178,20 @@ module.exports = function(User) {
 				}
 
 				var filename = data.uid + '-profilecover';
-				file.saveFileToLocal(filename, 'profile', image.path, function(err, upload) {
-					if (err) {
-						return next(err);
+				async.waterfall([
+					function (next) {
+						file.isFileTypeAllowed(data.file.path, next);
+					},
+					function (next) {
+						file.saveFileToLocal(filename, 'profile', image.path, next);
+					},
+					function (upload, next) {
+						next(null, {
+							url: nconf.get('relative_path') + upload.url,
+							name: image.name
+						});
 					}
-
-					next(null, {
-						url: nconf.get('relative_path') + upload.url,
-						name: image.name
-					});
-				});
+				], next);
 			},
 			function(uploadData, next) {
 				url = uploadData.url;