openhands
942bc6fc8d
- Remove production DB dump (db_backup_*.sql) and update.log from git tracking - Add DB backups to .gitignore - Replace all console.log/console.error with structured logger module - Translate Dutch error messages to English (link-discord.ts) - Remove dead code blocks (register-form.tsx false && pattern) - Add ESLint flat config with TypeScript, React, Next.js, jsx-a11y, and security plugins - Add Prettier config - Add eslint-plugin-security for security-aware linting - Fix all 119+ ESLint warnings across the codebase: - Resolve security/detect-object-injection with safe access patterns - Resolve security/detect-non-literal-fs-filename with path traversal validation - Replace <img> with next/image <Image> component - Remove unused variables and imports - Replace non-null assertions with proper type guards - Replace <a> with <Link> for internal navigation - Use next/script Script component for external scripts - Fix setState-in-useEffect anti-patterns (navbar-color-picker, logo-generator, theme-switcher) - Add lint and format scripts to package.json All checks: typecheck ✓, tests 58/58 ✓, lint 0 errors 0 warnings ✓
72 lines
2.2 KiB
TypeScript
72 lines
2.2 KiB
TypeScript
"use server";
|
|
|
|
import path from "node:path";
|
|
import { writeFile } from "node:fs/promises";
|
|
import { redirect } from "next/navigation";
|
|
import { requireStaff } from "@/lib/admin/guard";
|
|
import { logStaffActivity } from "@/lib/services/staff-activity";
|
|
|
|
// Writes a badge image to the configured emulator badge directory. The path is
|
|
// read from BADGE_UPLOAD_DIR so deployments can point it at their emulator's
|
|
// `swf/c_images/album1584` (or equivalent) without code changes. AtomCMS only
|
|
// ever stores .gif badges, so every upload is normalised to `<code>.gif`.
|
|
|
|
const CODE_RE = /^[A-Za-z0-9_-]{1,64}$/;
|
|
const MAX_BYTES = 1024 * 1024; // 1MB
|
|
const ALLOWED_TYPES = new Set(["image/gif", "image/png"]);
|
|
|
|
function back(param: string, value: string): never {
|
|
redirect(`/admin/badges?${param}=${encodeURIComponent(value)}`);
|
|
}
|
|
|
|
export async function uploadBadge(formData: FormData): Promise<void> {
|
|
const staff = await requireStaff();
|
|
|
|
const dir = process.env.BADGE_UPLOAD_DIR;
|
|
if (!dir) {
|
|
back("error", "Badge upload directory not configured");
|
|
}
|
|
|
|
const code = String(formData.get("code") ?? "").trim();
|
|
if (!CODE_RE.test(code)) {
|
|
back("error", "Invalid badge code (use A-Z, 0-9, _ or -, max 64 chars)");
|
|
}
|
|
|
|
const file = formData.get("file");
|
|
if (!(file instanceof File)) {
|
|
back("error", "No file uploaded");
|
|
}
|
|
|
|
if (file.size === 0) {
|
|
back("error", "Uploaded file is empty");
|
|
}
|
|
if (file.size > MAX_BYTES) {
|
|
back("error", "File too large (max 1MB)");
|
|
}
|
|
if (!ALLOWED_TYPES.has(file.type)) {
|
|
back("error", "File must be a GIF or PNG image");
|
|
}
|
|
|
|
try {
|
|
const buffer = Buffer.from(await file.arrayBuffer());
|
|
const baseDir = path.resolve(dir);
|
|
const target = path.resolve(baseDir, `${code}.gif`);
|
|
if (!target.startsWith(baseDir + path.sep)) {
|
|
back("error", "Invalid path");
|
|
}
|
|
// eslint-disable-next-line security/detect-non-literal-fs-filename
|
|
await writeFile(target, buffer);
|
|
} catch {
|
|
back("error", "Could not write the badge file to disk");
|
|
}
|
|
|
|
await logStaffActivity({
|
|
staffId: staff.id,
|
|
action: "badge_upload",
|
|
description: `Uploaded badge image "${code}.gif"`,
|
|
targetType: "badge",
|
|
});
|
|
|
|
redirect(`/admin/badges?uploaded=${encodeURIComponent(code)}`);
|
|
}
|