refactor(deleteFirebaseFile): add user id validation for firebase fil…

…e deletion
danny-avila · Jan 9, 2024 · f783926 · f783926
1 parent d457057
commit f783926
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/api/server/services/Files/Firebase/crud.js b/api/server/services/Files/Firebase/crud.js
@@ -161,6 +161,9 @@ function extractFirebaseFilePath(urlString) {
  */
 const deleteFirebaseFile = async (req, file) => {
   const fileName = extractFirebaseFilePath(file.filepath);
+  if (!fileName.includes(req.user.id)) {
+    throw new Error('Invalid file path');
+  }
   await deleteFile('', fileName);
 };