Ensure directories

app.js

@@ -22,6 +22,7 @@ router.delete('/api/files/*', files.del);
 app.use(morgan('dev'));
 app.use(morgan('dev'));
 app.use(compression());
 app.use(compression());
 app.use(bodyParser.json());
 app.use(bodyParser.json());
+app.use(express.static(__dirname + '/files'));
 app.use(router);
 app.use(router);
 app.use(lastMile());
 app.use(lastMile());
 
 

package.json

@@ -14,13 +14,16 @@
   "license": "MIT",
   "license": "MIT",
   "dependencies": {
   "dependencies": {
     "body-parser": "^1.13.1",
     "body-parser": "^1.13.1",
+    "commander": "^2.8.1",
     "compression": "^1.5.0",
     "compression": "^1.5.0",
     "connect-lastmile": "0.0.10",
     "connect-lastmile": "0.0.10",
     "connect-timeout": "^1.6.2",
     "connect-timeout": "^1.6.2",
     "ejs": "^2.3.1",
     "ejs": "^2.3.1",
     "express": "^4.12.4",
     "express": "^4.12.4",
+    "mkdirp": "^0.5.1",
     "morgan": "^1.6.0",
     "morgan": "^1.6.0",
     "multiparty": "^4.1.2",
     "multiparty": "^4.1.2",
-    "rimraf": "^2.4.0"
+    "rimraf": "^2.4.0",
+    "superagent": "^1.2.0"
   }
   }
 }
 }

src/files.js

@@ -4,6 +4,7 @@ var fs = require('fs'),
     path = require('path'),
     path = require('path'),
     ejs = require('ejs'),
     ejs = require('ejs'),
     rimraf = require('rimraf'),
     rimraf = require('rimraf'),
+    mkdirp = require('mkdirp'),
     HttpError = require('connect-lastmile').HttpError,
     HttpError = require('connect-lastmile').HttpError,
     HttpSuccess = require('connect-lastmile').HttpSuccess;
     HttpSuccess = require('connect-lastmile').HttpSuccess;
 
 
@@ -19,6 +20,10 @@ var FILE_BASE = path.resolve(__dirname, '../files');
 function copyFile(source, target, cb) {
 function copyFile(source, target, cb) {
     var cbCalled = false;
     var cbCalled = false;
 
 
+    // ensure directory
+    mkdirp(path.dirname(target), function (error) {
+        if (error) return cb(error);
+
         var rd = fs.createReadStream(source);
         var rd = fs.createReadStream(source);
             rd.on("error", function(err) {
             rd.on("error", function(err) {
             done(err);
             done(err);
@@ -41,6 +46,7 @@ function copyFile(source, target, cb) {
                 cbCalled = true;
                 cbCalled = true;
             }
             }
         }
         }
+    });
 }
 }
 
 
 function render(view, options) {
 function render(view, options) {
@@ -99,7 +105,8 @@ function put(req, res, next) {
 function del(req, res, next) {
 function del(req, res, next) {
     var filePath = req.params[0];
     var filePath = req.params[0];
     var absoluteFilePath = getAbsolutePath(filePath);
     var absoluteFilePath = getAbsolutePath(filePath);
-    if (!absoluteFilePath) return next(new HttpError(403, 'Path not allowed'));
+    if (!absoluteFilePath) return next(new HttpError(404, 'Not found'));
+    if (absoluteFilePath.slice(FILE_BASE.length) === '') return next(new HttpError(403, 'Forbidden'));
 
 
     fs.stat(absoluteFilePath, function (error, result) {
     fs.stat(absoluteFilePath, function (error, result) {
         if (error) return next(new HttpError(404, error));
         if (error) return next(new HttpError(404, error));