Fix sandboxing(#1)

README.md

@@ -1,4 +1,7 @@
 # nodejs-fm
+
+[![Build Status](https://travis-ci.org/chrisvrose/nodejs-fm.svg?branch=master)](https://travis-ci.org/chrisvrose/nodejs-fm)
+
 A simple file manager for managing files on a remote fs using Node. 
 
 Dependencies: `express` `body-parser` `sqlite`

index.js

@@ -44,7 +44,7 @@ let inDir = (dircheck,dirmain) => !path.relative(path.normalize(dircheck), dirma
 
 app.post('/files/ls',(req,res,next)=>{
     const location = processing.mergedir(req.body.loc,settings)
-
+    const nloc = path.normalize(req.body.loc);
     //Make sure not escaping the given path; insecure
     if(inDir(settings.dirname,location)){
         fs.readdir(location,{withFileTypes:true},(err,files)=>{
@@ -53,8 +53,8 @@ app.post('/files/ls',(req,res,next)=>{
             }
             else{
                 res.json({
-                    "location": location ,
-                    "back": inDir(settings.dirname, path.normalize(path.join(location,'..')) )?path.normalize(path.join(location,'..')):null,
+                    "loc": nloc ,
+                    "back": inDir(settings.dirname, path.normalize(path.join(location,'..')) )?path.normalize(path.join(nloc,'..')):null,
                     "contents":processing.dirprocess(files,location,settings)
                 })
             }

static/base.js

@@ -20,7 +20,7 @@ function updateContents(contents){
     //console.log(contents)
 
     // Change top header contents
-    $('#files-location').html(currDir.loc)
+    $('#files-location').html(contents.loc)
 
     // if empty, return null, this shouldnt execute if the server is responding properly but ok
     if(contents===null) {

test.js

@@ -18,6 +18,8 @@ describe('Page Status',()=>{
     it('POST /files/ls the home page',(done)=>{
         chai.request(testScript).post('/files/ls').send({'loc':'/'}).end((err,res)=>{
             res.should.have.status(200)
+            res.body.should.have.property('loc').eql('/')
+            res.body.should.have.property('back').eql(null)
             //TODO: MAKE SURE JSON FILE
             done()
         })