|
2 | 2 |
|
3 | 3 | import { $t } from "../i18n"; |
4 | 4 | import Router from "@koa/router"; |
| 5 | +import send from "koa-send"; |
5 | 6 | import fs from "fs-extra"; |
6 | 7 | import path from "path"; |
7 | 8 | import { missionPassport } from "../service/mission_passport"; |
@@ -30,17 +31,16 @@ router.get("/download/:key/:fileName", async (ctx) => { |
30 | 31 |
|
31 | 32 | const cwd = instance.config.cwd; |
32 | 33 | const fileRelativePath = mission.parameter.fileName; |
33 | | - const ext = path.extname(fileRelativePath); |
| 34 | + |
34 | 35 | // Check for file cross-directory security risks |
35 | 36 | const fileManager = new FileManager(cwd); |
36 | 37 | if (!fileManager.check(fileRelativePath)) throw new Error((ctx.body = "Access denied: Invalid destination")); |
37 | 38 |
|
38 | | - // start downloading the file to the user |
39 | | - ctx.response.set("Content-Disposition", `attachment; filename="${encodeURIComponent(paramsFileName)}"`); |
40 | | - ctx.type = ext; |
41 | | - ctx.body = fs.createReadStream(fileManager.toAbsolutePath(fileRelativePath)); |
42 | | - // The task has been executed, destroy the passport |
43 | | - missionPassport.deleteMission(key); |
| 39 | + // send File |
| 40 | + const fileAbsPath = fileManager.toAbsolutePath(fileRelativePath); |
| 41 | + const fileDir = path.dirname(fileAbsPath); |
| 42 | + const fileName = path.basename(fileAbsPath); |
| 43 | + await send(ctx, fileName, { root: fileDir + "/" }); |
44 | 44 | } catch (error) { |
45 | 45 | ctx.body = $t("http_router.downloadErr", { error: error.message }); |
46 | 46 | ctx.status = 500; |
|
0 commit comments