Merge remote-tracking branch 'origin/56/merge'

Author: aguidrevitch

lib/uploadhandler.js

@@ -174,9 +174,21 @@ module.exports = function (options) {
         var self = this,
             fileName = path.basename(decodeURIComponent(this.req.url));
 
-        fs.unlink(options.uploadDir() + '/' + fileName, function (ex) {
+        var filepath = path.join(options.uploadDir(), fileName);
+        if (filepath.indexOf(options.uploadDir()) !== 0) {
+            self.emit('delete', fileName);
+            self.callback({success: false});            
+            return;
+        }
+        fs.unlink(filepath, function (ex) {
             _.each(options.imageVersions, function (value, version) {
-                fs.unlink(options.uploadDir() + '/' + version + '/' + fileName);
+                var versionfilepath = path.join(options.uploadDir(), version, fileName);
+                if (versionfilepath.indexOf(options.uploadDir()) !== 0) {
+                    self.emit('delete', fileName);
+                    self.callback({success: false});            
+                    return;
+                }
+                fs.unlink(versionfilepath);
             });
             self.emit('delete', fileName);
             self.callback({success: !ex});