From a7762aea4fa0cade3614323a83d6f8d74ade924a Mon Sep 17 00:00:00 2001
From: otofune <otofune@gmail.com>
Date: Tue, 7 Nov 2017 09:18:40 +0900
Subject: [PATCH] file - if 'name' param given, validate

---
 src/file/server.ts | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/file/server.ts b/src/file/server.ts
index e83acd4f24..1152b650be 100644
--- a/src/file/server.ts
+++ b/src/file/server.ts
@@ -86,7 +86,7 @@ function send(data: Buffer, type: string, req: express.Request, res: express.Res
 	}
 }
 
-async function sendFileById (req: express.Request, res: express.Response): Promise<void> {
+async function sendFileById(req: express.Request, res: express.Response): Promise<void> {
 	// Validate id
 	if (!mongodb.ObjectID.isValid(req.params.id)) {
 		res.status(400).send('incorrect id');
@@ -96,6 +96,12 @@ async function sendFileById (req: express.Request, res: express.Response): Promi
 	const fileId = new mongodb.ObjectID(req.params.id);
 	const file = await DriveFile.findOne({ _id: fileId });
 
+	// validate name
+	if (req.params.name !== undefined && req.params.name !== file.metadata.name) {
+		res.status(404).send('there is no file has given name');
+		return;
+	}
+
 	if (file == null) {
 		res.status(404).sendFile(`${__dirname}/assets/dummy.png`);
 		return;