fix: use req.ip instead, since guests can upload as well

src/middleware/uploads.js

@@ -4,7 +4,6 @@ const LRU = require('lru-cache');
 const meta = require('../meta');
 const helpers = require('./helpers');
 const user = require('../user');
-const controllerHelpers = require('../controllers/helpers');
 
 const cache = new LRU({
 	maxAge: meta.config.uploadRateLimitThreshold * 1000,
@@ -13,20 +12,16 @@ const cache = new LRU({
 module.exports = function (middleware) {
 	middleware.ratelimitUploads = helpers.try(async (req, res, next) => {
 		const { uid } = req;
-		if (!uid) {
-			return controllerHelpers.notAllowed(req, res);
-		}
-
-		if (!meta.config.uploadRateLimitThreshold || await user.isAdminOrGlobalMod(req.uid)) {
+		if (!meta.config.uploadRateLimitThreshold || uid && await user.isAdminOrGlobalMod(uid)) {
 			return next();
 		}
 
-		const count = (cache.peek(`${uid}:uploaded_file_count`) || 0) + req.files.files.length;
+		const count = (cache.peek(`${req.ip}:uploaded_file_count`) || 0) + req.files.files.length;
 		if (count > meta.config.uploadRateLimitThreshold) {
 			return next(new Error(['[[error:upload-ratelimit-reached]]']));
 		}
 
-		cache.set(`${uid}:uploaded_file_count`, count);
+		cache.set(`${req.ip}:uploaded_file_count`, count);
 		next();
 	});
 };

test/uploads.js

@@ -151,6 +151,16 @@ describe('Upload Controllers', () => {
 			});
 		});
 
+		it('should fail to upload image to post if image is broken', (done) => {
+			helpers.uploadFile(`${nconf.get('url')}/api/post/upload`, path.join(__dirname, '../test/files/brokenimage.png'), {}, jar, csrf_token, (err, res, body) => {
+				assert.ifError(err);
+				assert.strictEqual(res.statusCode, 500);
+				assert(body && body.status && body.status.message);
+				assert(body.status.message.startsWith('Input file has corrupt header: pngload: end of stream'));
+				done();
+			});
+		});
+
 		it('should fail to upload image to post if image dimensions are too big', (done) => {
 			helpers.uploadFile(`${nconf.get('url')}/api/post/upload`, path.join(__dirname, '../test/files/toobig.jpg'), {}, jar, csrf_token, (err, res, body) => {
 				assert.ifError(err);