fix: Fix path traversal vulnerability

Closes #276

SECURITY.md

@@ -0,0 +1,13 @@
+# Security Policy
+
+## Supported Versions
+
+Most recent release.
+
+## Reporting a Vulnerability
+
+Please report any security issues you discovered to meltyshev@gmail.com. If the issue is confirmed, we will release a patch as soon as possible depending on complexity.
+
+**Do NOT create public issues on GitHub for security vulnerabilities.**
+
+Thank you for your contribution!

package.json

@@ -1,6 +1,6 @@
 {
   "name": "planka",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "private": true,
   "homepage": "https://plankanban.github.io/planka",
   "repository": {

server/api/controllers/attachments/download-thumbnail.js

@@ -14,10 +14,6 @@ module.exports = {
       regex: /^[0-9]+$/,
       required: true,
     },
-    filename: {
-      type: 'string',
-      required: true,
-    },
   },
 
   exits: {
@@ -54,14 +50,14 @@ module.exports = {
       sails.config.custom.attachmentsPath,
       attachment.dirname,
       'thumbnails',
-      inputs.filename,
+      'cover-256.jpg',
     );
 
     if (!fs.existsSync(filePath)) {
       throw Errors.ATTACHMENT_NOT_FOUND;
     }
 
-    this.res.type(attachment.filename);
+    this.res.type('image/jpeg');
     this.res.set('Cache-Control', 'private, max-age=900'); // TODO: move to config
 
     return exits.success(fs.createReadStream(filePath));

server/config/routes.js

@@ -80,7 +80,7 @@ module.exports.routes = {
     skipAssets: false,
   },
 
-  'GET /attachments/:id/download/thumbnails/:filename': {
+  'GET /attachments/:id/download/thumbnails/cover-256.jpg': {
     action: 'attachments/download-thumbnail',
     skipAssets: false,
   },