From 550f472451755d095cf5802bc91f403e85b7129e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Emrik=20=C3=96stling?= <emrik.ostling@gmail.com>
Date: Mon, 1 Dec 2025 22:26:56 +0100
Subject: [PATCH] Merge commit from fork

---
 src/pages/upload.tsx | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/pages/upload.tsx b/src/pages/upload.tsx
index eeaae1c..6e2b2dd 100644
--- a/src/pages/upload.tsx
+++ b/src/pages/upload.tsx
@@ -3,6 +3,7 @@ import db from "../db/db";
 import { WEBROOT } from "../helpers/env";
 import { uploadsDir } from "../index";
 import { userService } from "./user";
+import sanitize from "sanitize-filename";
 
 export const upload = new Elysia().use(userService).post(
   "/upload",
@@ -24,10 +25,12 @@ export const upload = new Elysia().use(userService).post(
     if (body?.file) {
       if (Array.isArray(body.file)) {
         for (const file of body.file) {
-          await Bun.write(`${userUploadsDir}${file.name}`, file);
+          const santizedFileName = sanitize(file.name)
+          await Bun.write(`${userUploadsDir}${santizedFileName}`, file);
         }
       } else {
-        await Bun.write(`${userUploadsDir}${body.file["name"]}`, body.file);
+        const santizedFileName = sanitize(body.file["name"])
+        await Bun.write(`${userUploadsDir}${santizedFileName}`, body.file);
       }
     }