fix: prevent upload bypass via uppercase path

requarks · Jan 29, 2022 · 7b14b39 · 7b14b39
1 parent cab16ee
commit 7b14b39
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/server/helpers/security.js b/server/helpers/security.js
@@ -32,7 +32,7 @@ module.exports = {
         token = req.cookies['jwt']
       }
       // Force uploads to use Auth headers
-      if (req.path === '/u') {
+      if (req.path.toLowerCase() === '/u') {
         return null
       }
       return token