removed dead code
This commit is contained in:
@@ -1,13 +1,10 @@
|
||||
const express = require('express');
|
||||
const helmet = require('helmet');
|
||||
const { Message, User } = require('../models');
|
||||
const { authenticateToken } = require('../middleware/auth');
|
||||
const logger = require('../utils/logger');
|
||||
const { emitNewMessage, emitMessageRead } = require('../sockets/messageSocket');
|
||||
const { Op } = require('sequelize');
|
||||
const emailServices = require('../services/email');
|
||||
const fs = require('fs');
|
||||
const path = require('path');
|
||||
const { validateS3Keys } = require('../utils/s3KeyValidator');
|
||||
const { IMAGE_LIMITS } = require('../config/imageLimits');
|
||||
const router = express.Router();
|
||||
@@ -395,53 +392,4 @@ router.get('/unread/count', authenticateToken, async (req, res, next) => {
|
||||
}
|
||||
});
|
||||
|
||||
// Get message image (authorized)
|
||||
router.get('/images/:filename',
|
||||
authenticateToken,
|
||||
// Override Helmet's CORP header for cross-origin image loading
|
||||
helmet.crossOriginResourcePolicy({ policy: "cross-origin" }),
|
||||
async (req, res) => {
|
||||
try {
|
||||
// Sanitize filename to prevent path traversal attacks
|
||||
const filename = path.basename(req.params.filename);
|
||||
|
||||
// Verify user is sender or receiver of a message with this image
|
||||
const message = await Message.findOne({
|
||||
where: {
|
||||
imageFilename: filename,
|
||||
[Op.or]: [
|
||||
{ senderId: req.user.id },
|
||||
{ receiverId: req.user.id }
|
||||
]
|
||||
}
|
||||
});
|
||||
|
||||
if (!message) {
|
||||
const reqLogger = logger.withRequestId(req.id);
|
||||
reqLogger.warn('Unauthorized image access attempt', {
|
||||
userId: req.user.id,
|
||||
filename
|
||||
});
|
||||
return res.status(403).json({ error: 'Access denied' });
|
||||
}
|
||||
|
||||
// Serve the image
|
||||
const filePath = path.join(__dirname, '../uploads/messages', filename);
|
||||
|
||||
if (!fs.existsSync(filePath)) {
|
||||
return res.status(404).json({ error: 'Image not found' });
|
||||
}
|
||||
|
||||
res.sendFile(filePath);
|
||||
} catch (error) {
|
||||
const reqLogger = logger.withRequestId(req.id);
|
||||
reqLogger.error('Image serve failed', {
|
||||
error: error.message,
|
||||
stack: error.stack,
|
||||
filename: req.params.filename
|
||||
});
|
||||
res.status(500).json({ error: 'Failed to load image' });
|
||||
}
|
||||
});
|
||||
|
||||
module.exports = router;
|
||||
Reference in New Issue
Block a user