From 9fba2682888ad93816cf98f749562f4671cb235d Mon Sep 17 00:00:00 2001
From: Daan Sprenkels <hello@dsprenkels.com>
Date: Tue, 27 Nov 2018 22:56:53 +0100
Subject: [PATCH] Prevent subdirectories in user export

This commit also refactors the code a bit, and adds a '-' separator
between a filename and its duplicate index.

This commit fixes #1079.

Signed-off-by: Daan Sprenkels <hello@dsprenkels.com>
---
 lib/web/userRouter.js | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/lib/web/userRouter.js b/lib/web/userRouter.js
index db786d53..ca364422 100644
--- a/lib/web/userRouter.js
+++ b/lib/web/userRouter.js
@@ -90,18 +90,20 @@ UserRouter.get('/me/export', function (req, res) {
           ownerId: user.id
         }
       }).then(function (notes) {
-        let list = []
+        let filenames = {}
         async.each(notes, function (note, callback) {
-          let title
-          let extension = ''
+          let basename = note.title.replace(/\//g, '-') // Prevent subdirectories
+          let filename
+          let suffix = ''
           do {
-            title = note.title + extension
-            extension++
-          } while (list.indexOf(title) !== -1)
+            let seperator = typeof suffix === 'number' ? '-' : ''
+            filename = basename + seperator + suffix + '.md'
+            suffix++
+          } while (filenames[filename])
+          filenames[filename] = true
 
-          list.push(title)
-          logger.debug('Write: ' + title + '.md')
-          archive.append(Buffer.from(note.content), { name: title + '.md', date: note.lastchangeAt })
+          logger.debug('Write: ' + filename)
+          archive.append(Buffer.from(note.content), { name: filename, date: note.lastchangeAt })
           callback(null, null)
         }, function (err) {
           if (err) {