From c3e50a2727f84a249f3df4bbd1cc8dd9d182f167 Mon Sep 17 00:00:00 2001
From: AlexeerCT <acazares@aduanasoft.com.mx>
Date: Wed, 15 Apr 2026 17:16:40 -0500
Subject: [PATCH] Enhance file handling in server routes

- Added checks to ensure only regular files are processed in both the main and backup server routes.
- Improved error handling for invalid file parameters and inaccessible backup files, returning appropriate HTTP responses.
---
 src/routes/+page.server.ts   |  2 ++
 src/routes/backup/+server.ts | 13 ++++++++++++-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/src/routes/+page.server.ts b/src/routes/+page.server.ts
index 82c39c8..b5467ba 100644
--- a/src/routes/+page.server.ts
+++ b/src/routes/+page.server.ts
@@ -138,6 +138,8 @@ export const load: PageServerLoad = async ({ cookies }) => {
                 stats = await fs.stat(filePath);
             } catch { continue; }
 
+            if (!stats.isFile()) continue;
+
             const nodoName = path.parse(file).name;
             let clientData: any = null;
 
diff --git a/src/routes/backup/+server.ts b/src/routes/backup/+server.ts
index 98b4807..e2d3519 100644
--- a/src/routes/backup/+server.ts
+++ b/src/routes/backup/+server.ts
@@ -15,8 +15,19 @@ export const GET = async ({ url }: { url: URL }) => {
         return new Response('Backup path is not configured', { status: 500 });
     }
 
+    const resolvedBase = path.resolve(basePath);
+    const filePath = path.resolve(resolvedBase, fileName);
+    const relativeToBase = path.relative(resolvedBase, filePath);
+    if (relativeToBase.startsWith('..') || path.isAbsolute(relativeToBase)) {
+        return new Response('Invalid file parameter', { status: 400 });
+    }
+
     try {
-        const filePath = path.join(basePath, fileName);
+        const st = await fs.stat(filePath);
+        if (!st.isFile()) {
+            console.error('Backup path is not a regular file:', filePath);
+            return new Response('Backup file not found or inaccessible', { status: 404 });
+        }
         console.log('Serving backup file from', filePath);
         const data = await fs.readFile(filePath);
         const headers = new Headers();