Changeset c9d48fc in Klonkt

Timestamp:

06/22/2026 01:58:08 PM (3 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

3bb8719

Parents:

17197a9

Message:

fix(download): /bestand used storage_path (absolute) -> Bad path; now uses m.filename

The path guard rejected the absolute storage_path. Now uses the bare m.filename
+ AUDIO_DIR, just like /audio/stream.

Co-Authored-By: Claude <noreply@…>

File:

• src/routes/download.js (modified) (2 diffs)

src/routes/download.js

@@ -44 +44 @@
 function dlTrack(siteId, id) {
   return db.prepare(
-    `SELECT t.id, t.title, t.artist, t.cover_url, m.storage_path
+    `SELECT t.id, t.title, t.artist, t.cover_url, m.storage_path, m.filename
        FROM audio_tracks t JOIN media m ON m.id = t.media_id
       WHERE t.id = ? AND t.site_id = ? AND t.downloadable = 1`
@@ -129 +129 @@
     return res.status(403).send('Laat eerst je e-mailadres achter om te downloaden.');
   }
-  const sp = track.storage_path;
+  // De speelbare/te-downloaden file = de KALE filename (storage_path is een
+  // absoluut pad → faalt de slash-guard). Zelfde aanpak als /audio/stream.
+  const sp = track.filename;
   if (!sp || sp.includes('/') || sp.includes('\\') || sp.includes('..')) return res.status(400).send('Bad path');
   const filePath = path.join(AUDIO_DIR, sp);