fix(assets): security fix

polonel · Oct 16, 2018 · 4f6c00d · 4f6c00d
1 parent 5c50b67
commit 4f6c00d
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/src/middleware/index.js b/src/middleware/index.js
@@ -95,11 +95,12 @@ module.exports = function(app, db, callback) {
 
             //CORS
             app.use(allowCrossDomain);
-            app.use('/uploads/tickets', express.static(path.join(__dirname, '../../', 'public', 'uploads', 'tickets')));
-
             //Mobile
             app.use('/mobile', express.static(path.join(__dirname, '../../', 'mobile')));
 
+            app.use('/uploads/tickets', middleware.redirectToLogin, express.static(path.resolve(__dirname, '/public/uploads/tickets')));
+            app.use('/uploads/users', middleware.redirectToLogin, express.static(path.resolve(__dirname, '/public/uploads/users')));
+
             app.use(express.static(path.join(__dirname, '../../', 'public')));
 
             //Remove to enable plugins