@@ -374,17 +387,35 @@ class Dashboard {
`;
}
- hasSubFrameCleanup(objects) {
- const objectsWithSubFrames = objects.filter(obj => obj.hasSubFrames);
- if (objectsWithSubFrames.length === 0) return false;
+ // Returns all sub-folders for an object (Eq and/or Alt/Az), with legacy fallback.
+ _getSubFolders(obj) {
+ const sfs = [obj.subFolderEq, obj.subFolderAltAz].filter(Boolean);
+ if (sfs.length === 0 && obj.subFolder) sfs.push(obj.subFolder);
+ return sfs;
+ }
- for (const obj of objectsWithSubFrames) {
- if (obj.subFolder) {
- const nonFitFiles = obj.subFolder.files.filter(f => !f.endsWith('.fit'));
- if (nonFitFiles.length > 0) return true;
- }
- }
- return false;
+ // Count non-.fit files across all sub-folders of an object.
+ _countNonFitSubFiles(obj) {
+ return this._getSubFolders(obj)
+ .reduce((sum, sf) => sum + sf.files.filter(f => !f.endsWith('.fit')).length, 0);
+ }
+
+ // Render a mount mode badge for the given mountMode value.
+ _mountModeBadge(mountMode) {
+ if (!mountMode) return '';
+ const cfg = {
+ eq: { label: 'EQ', color: 'var(--info-color, #3498db)' },
+ altaz: { label: 'Alt/Az', color: 'var(--accent-color, #9b59b6)' },
+ both: { label: 'Both', color: 'var(--success-color, #2ecc71)' }
+ };
+ const { label, color } = cfg[mountMode] || { label: mountMode, color: 'var(--text-secondary)' };
+ return `${label} `;
+ }
+
+ hasSubFrameCleanup(objects) {
+ return objects.some(obj => obj.hasSubFrames && this._countNonFitSubFiles(obj) > 0);
}
renderEmptyDirectories(emptyDirectories) {
@@ -431,20 +462,15 @@ class Dashboard {
return ''; // No sub-frames, no cleanup needed
}
- // Calculate potential cleanup
+ // Calculate potential cleanup across both sub-folder types
let totalNonFitFiles = 0;
const objectsWithJpg = [];
for (const obj of objectsWithSubFrames) {
- if (obj.subFolder) {
- const nonFitFiles = obj.subFolder.files.filter(f => !f.endsWith('.fit'));
- if (nonFitFiles.length > 0) {
- totalNonFitFiles += nonFitFiles.length;
- objectsWithJpg.push({
- name: obj.displayName,
- count: nonFitFiles.length
- });
- }
+ const count = this._countNonFitSubFiles(obj);
+ if (count > 0) {
+ totalNonFitFiles += count;
+ objectsWithJpg.push({ name: obj.displayName, count });
}
}
@@ -476,7 +502,7 @@ class Dashboard {
- What will be deleted: All files except .fit files in sub-frame directories (_sub folders).
+ What will be deleted: All files except .fit files in sub-frame directories (_sub for EQ mode, -sub for Alt/Az mode).
This includes JPG previews and thumbnails which are not needed.
@@ -550,6 +576,7 @@ class Dashboard {
Object
+ Mount
Catalog
Sub-Frames
Sub .fit
@@ -568,18 +595,19 @@ class Dashboard {
}
renderObjectRow(obj, index) {
- const totalFiles = obj.mainFolder.fileCount + (obj.subFolder ? obj.subFolder.fileCount : 0);
- const totalSize = obj.mainFolder.size + (obj.subFolder ? obj.subFolder.size : 0);
+ const allSubs = this._getSubFolders(obj);
+ const totalFiles = obj.mainFolder.fileCount + allSubs.reduce((s, sf) => s + sf.fileCount, 0);
+ const totalSize = obj.mainFolder.size + allSubs.reduce((s, sf) => s + sf.size, 0);
const bgColor = index % 2 === 0 ? 'transparent' : 'var(--bg-tertiary)';
const hoverBgColor = index % 2 === 0 ? 'var(--bg-tertiary)' : 'var(--bg-secondary)';
- // Count .fit and non-.fit files in sub-frame folder
- let subFitCount = 0;
- let subOtherCount = 0;
- if (obj.subFolder) {
- subFitCount = obj.subFolder.files.filter(f => f.endsWith('.fit')).length;
- subOtherCount = obj.subFolder.files.filter(f => !f.endsWith('.fit')).length;
- }
+ // Count .fit and non-.fit files across all sub-frame folders
+ const subFitCount = allSubs.reduce((s, sf) => s + sf.files.filter(f => f.endsWith('.fit')).length, 0);
+ const subOtherCount = allSubs.reduce((s, sf) => s + sf.files.filter(f => !f.endsWith('.fit')).length, 0);
+
+ const sessions = this.parseImagingSessions(obj);
+ const sessionIntegration = sessions.reduce((sum, s) => sum + s.stackCount * s.exposure, 0);
+ const integrationTime = obj.totalIntegrationTime > 0 ? obj.totalIntegrationTime : sessionIntegration;
const rowId = `object-row-${obj.name.replace(/\s+/g, '-')}`;
@@ -593,6 +621,9 @@ class Dashboard {
${obj.displayName}
${obj.isMosaic ? 'Mosaic ' : ''}
+
+ ${obj.hasSubFrames ? this._mountModeBadge(obj.mountMode) : 'โ '}
+
${obj.catalog}
${obj.hasSubFrames ? 'โ ' : 'โ '}
@@ -604,7 +635,7 @@ class Dashboard {
${obj.hasSubFrames ? subOtherCount : '-'}
- ${obj.totalIntegrationTime > 0 ? this.formatIntegrationTime(obj.totalIntegrationTime) : '-'}
+ ${integrationTime > 0 ? this.formatIntegrationTime(integrationTime) : '-'}
${totalFiles}
${app.formatBytes(totalSize)}
@@ -774,13 +805,10 @@ class Dashboard {
return;
}
- // Calculate total files to delete
+ // Calculate total files to delete across both sub-folder types
let totalFiles = 0;
for (const obj of objectsWithSubFrames) {
- if (obj.subFolder) {
- const nonFitFiles = obj.subFolder.files.filter(f => !f.endsWith('.fit'));
- totalFiles += nonFitFiles.length;
- }
+ totalFiles += this._countNonFitSubFiles(obj);
}
const confirmMessage = `
@@ -790,7 +818,7 @@ class Dashboard {
This will delete approximately ${totalFiles} files (JPG and thumbnail files) from ${objectsWithSubFrames.length} sub-frame folders.
- What will be deleted: All files except .fit files in _sub directories.
+ What will be deleted: All files except .fit files in sub-frame directories (_sub for EQ mode, -sub for Alt/Az mode).
Safe: Your .fit files will NOT be touched. This operation is safe.
@@ -879,22 +907,28 @@ class Dashboard {
return;
}
- // Count non-.fit files
- const nonFitFiles = object.subFolder.files.filter(f => !f.endsWith('.fit'));
+ // Count non-.fit files across all sub-folders (EQ _sub and/or Alt/Az -sub)
+ const totalNonFit = this._countNonFitSubFiles(object);
- if (nonFitFiles.length === 0) {
+ if (totalNonFit === 0) {
app.showModal('Nothing to Clean', '
This object has no non-.fit files to clean up.
', null, 'Close');
return;
}
+ const folderLabel = {
+ eq: 'the _sub directory (EQ mode)',
+ altaz: 'the -sub directory (Alt/Az mode)',
+ both: 'both the _sub (EQ) and -sub (Alt/Az) directories'
+ }[object.mountMode] || 'sub-frame directories';
+
const confirmMessage = `
-
Clean up sub-frame directory for ${object.displayName} ?
+
Clean up sub-frame ${object.mountMode === 'both' ? 'directories' : 'directory'} for ${object.displayName} ?
- This will delete ${nonFitFiles.length} file${nonFitFiles.length === 1 ? '' : 's'} (JPG and thumbnail files).
+ This will delete ${totalNonFit} file${totalNonFit === 1 ? '' : 's'} (JPG and thumbnail files).
- What will be deleted: All files except .fit files in the _sub directory.
+ What will be deleted: All files except .fit files in ${folderLabel}.
Safe: Your .fit files will NOT be touched.
@@ -1029,10 +1063,12 @@ class Dashboard {
const withSubFrames = filteredObjects.filter(obj => obj.hasSubFrames).length;
const withoutSubFrames = filteredObjects.filter(obj => !obj.hasSubFrames).length;
const totalFiles = filteredObjects.reduce((sum, obj) => {
- return sum + obj.mainFolder.fileCount + (obj.subFolder ? obj.subFolder.fileCount : 0);
+ const sfs = this._getSubFolders(obj);
+ return sum + obj.mainFolder.fileCount + sfs.reduce((s, sf) => s + sf.fileCount, 0);
}, 0);
const totalSize = filteredObjects.reduce((sum, obj) => {
- return sum + obj.mainFolder.size + (obj.subFolder ? obj.subFolder.size : 0);
+ const sfs = this._getSubFolders(obj);
+ return sum + obj.mainFolder.size + sfs.reduce((s, sf) => s + sf.size, 0);
}, 0);
const totalIntegration = filteredObjects.reduce((sum, obj) => sum + obj.totalIntegrationTime, 0);
@@ -1372,8 +1408,15 @@ class Dashboard {
const detailContent = document.querySelector('.object-detail-content');
if (!detailContent) return;
- const totalFiles = obj.mainFolder.fileCount + (obj.subFolder ? obj.subFolder.fileCount : 0);
- const totalSize = obj.mainFolder.size + (obj.subFolder ? obj.subFolder.size : 0);
+ const allSubs = this._getSubFolders(obj);
+ const totalFiles = obj.mainFolder.fileCount + allSubs.reduce((s, sf) => s + sf.fileCount, 0);
+ const totalSize = obj.mainFolder.size + allSubs.reduce((s, sf) => s + sf.size, 0);
+
+ // Integration time: prefer sub-frame-derived value; fall back to sum(stackCount ร exposure)
+ // across sessions so objects without sub-frames also show a meaningful figure.
+ const sessions = this.parseImagingSessions(obj);
+ const sessionIntegration = sessions.reduce((sum, s) => sum + s.stackCount * s.exposure, 0);
+ const integrationTime = obj.totalIntegrationTime > 0 ? obj.totalIntegrationTime : sessionIntegration;
detailContent.innerHTML = `
@@ -1402,11 +1445,12 @@ class Dashboard {
Catalog: ${obj.catalog} ${obj.catalogNumber ? `ยท Number: ${obj.catalogNumber} ` : ''}
+ ${obj.hasSubFrames ? `ยท Mount Mode: ${this._mountModeBadge(obj.mountMode)}` : ''}
- ${obj.hasSubFrames && obj.subFolder && obj.subFolder.files.filter(f => !f.endsWith('.fit')).length > 0 ? `
+ ${obj.hasSubFrames && this._countNonFitSubFiles(obj) > 0 ? `
- ${this.renderSummaryCard('๐', 'Total Files', totalFiles, 'primary')}
- ${this.renderSummaryCard('๐พ', 'Total Size', app.formatBytes(totalSize), 'success')}
- ${this.renderSummaryCard('โฑ๏ธ', 'Integration Time', obj.totalIntegrationTime > 0 ? this.formatIntegrationTime(obj.totalIntegrationTime) : '-', 'info')}
- ${this.renderSummaryCard('๐ฆ', 'Sub-Frames', obj.hasSubFrames ? 'Yes' : 'No', obj.hasSubFrames ? 'secondary' : 'accent')}
- ${obj.lightFrameCount > 0 ? this.renderSummaryCard('๐', 'Light Frames', obj.lightFrameCount, 'warning') : ''}
+
+ ${this.renderSummaryCard('๐', 'Total Files', totalFiles, 'primary', true)}
+ ${this.renderSummaryCard('๐พ', 'Total Size', app.formatBytes(totalSize), 'success', true)}
+ ${this.renderSummaryCard('โฑ๏ธ', 'Integration Time', integrationTime > 0 ? this.formatIntegrationTime(integrationTime) : '-', 'info', true)}
+ ${this.renderSummaryCard('๐ฆ', 'Sub-Frames', obj.hasSubFrames ? 'Yes' : 'No', obj.hasSubFrames ? 'secondary' : 'accent', true)}
+ ${obj.lightFrameCount > 0 ? this.renderSummaryCard('๐', 'Light Frames', obj.lightFrameCount, 'warning', true) : this.renderSummaryCard('๐', 'Light Frames', '-', 'warning', true)}
@@ -1453,35 +1497,39 @@ class Dashboard {
${this.renderFileList(obj.mainFolder.files, 'Main Folder Files', obj.mainFolder.path)}
-
- ${obj.hasSubFrames && obj.subFolder ? `
+
+ ${allSubs.map(sf => {
+ const modeLabel = sf === obj.subFolderEq ? 'Eq' : 'Alt/Az';
+ const fitCount = sf.files.filter(f => f.endsWith('.fit')).length;
+ const otherCount= sf.files.filter(f => !f.endsWith('.fit')).length;
+ return `
-
๐ฆ Sub-Frames Folder
-
+
๐ฆ Sub-Frames Folder (${modeLabel} mount mode)
+
Location
-
${obj.subFolder.path}
+
${sf.path}
Files
-
${obj.subFolder.fileCount}
+
${sf.fileCount}
Size
-
${app.formatBytes(obj.subFolder.size)}
+
${app.formatBytes(sf.size)}
.fit Files
-
${obj.subFolder.files.filter(f => f.endsWith('.fit')).length}
+
${fitCount}
Other Files
-
${obj.subFolder.files.filter(f => !f.endsWith('.fit')).length}
+
${otherCount}
- ${this.renderFileList(obj.subFolder.files, 'Sub-Frame Files', obj.subFolder.path)}
-
- ` : ''}
+ ${this.renderFileList(sf.files, 'Sub-Frame Files', sf.path)}
+
`;
+ }).join('')}
No main folder files found for this session.
'}
-
- ${obj.subFolder ? `
-
-
๐ฆ Sub-Frame Light Frames (${subFiles.length})
- ${subFiles.length > 0
- ? this.renderFileList(subFiles, 'Session Light Frames', obj.subFolder.path, true)
- : '
No sub-frame files found for this session.
'}
-
+
๐ฆ Sub-Frame Light Frames โ ${modeLabel} (${filesHere.length})
+ ${filesHere.length > 0
+ ? this.renderFileList(filesHere, 'Session Light Frames', sf.path, true)
+ : '
No sub-frame files found for this session.
'}
+
Delete all files from the session on ${session.date} at ${session.time} ?
๐ Main folder: ${mainFiles.length} file${mainFiles.length !== 1 ? 's' : ''}
- ${subFiles.length > 0 ? `๐ฆ Sub-frames: ${subFiles.length} file${subFiles.length !== 1 ? 's' : ''} ` : ''}
+ ${subFiles.length > 0 ? `๐ฆ Sub-frames: ${subFiles.length} file${subFiles.length !== 1 ? 's' : ''} (across ${[...new Set(subFiles.map(f => f.folder))].length} folder${[...new Set(subFiles.map(f => f.folder))].length !== 1 ? 's' : ''}) ` : ''}
Total: ${totalFiles} files
โ ๏ธ This cannot be undone.
@@ -1666,9 +1730,8 @@ class Dashboard {
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
mainFolderPath: obj.mainFolder.path,
- subFolderPath: obj.subFolder ? obj.subFolder.path : null,
mainFiles,
- subFiles
+ subFiles // array of { folder, file } โ already in the right format
})
});
diff --git a/server.js b/server.js
index ec8774d..2830ccd 100644
--- a/server.js
+++ b/server.js
@@ -28,6 +28,8 @@ const APP_VERSION = readAppVersion();
// Create Express app
const app = express();
+// HTTP is intentional โ this server listens on localhost only and is never exposed
+// to a network, so HTTPS/TLS provides no meaningful security benefit here.
const server = http.createServer(app);
const io = socketIO(server);
@@ -76,9 +78,44 @@ const HOST = config.server.host || 'localhost';
app.use(express.json({ limit: '50mb' }));
app.use(express.urlencoded({ extended: true, limit: '50mb' }));
app.use(express.static(path.join(__dirname, 'public')));
+app.disable('x-powered-by'); // Do not advertise the framework in response headers
+
+// Simple in-memory rate limiter for expensive endpoints (CWE-770)
+// windowMs: rolling window length; max: max requests per window per IP
+function createRateLimiter({ windowMs = 60_000, max = 10 } = {}) {
+ const hits = new Map(); // ip -> [timestamps]
+ return (req, res, next) => {
+ const ip = req.ip || req.connection.remoteAddress || 'unknown';
+ const now = Date.now();
+ const window = (hits.get(ip) || []).filter(t => now - t < windowMs);
+ if (window.length >= max) {
+ return res.status(429).json({ success: false, error: 'Too many requests, please try again later.' });
+ }
+ window.push(now);
+ hits.set(ip, window);
+ next();
+ };
+}
+
+// Rate limiters for expensive file-system operations
+const heavyOpLimiter = createRateLimiter({ windowMs: 60_000, max: 10 }); // import/merge start
+const analysisLimiter = createRateLimiter({ windowMs: 60_000, max: 30 }); // analyze / space checks
+const lightLimiter = createRateLimiter({ windowMs: 60_000, max: 200 }); // static pages / image serving
+
+// Path allowlist โ rejects any path that does not resolve to a recognised Windows root.
+// Allows any drive letter (A-Z:\) and UNC paths (\\server\share) so the user can
+// browse and operate on any drive they have authorised, while blocking anything that
+// resolves outside a real Windows filesystem root (CWE-22).
+function isAllowedPath(resolvedPath) {
+ if (!path.isAbsolute(resolvedPath)) return false;
+ if (/^[A-Za-z]:[/\\]/.test(resolvedPath)) return true; // drive-letter root
+ if (resolvedPath.startsWith('\\\\')) return true; // UNC / network path
+ return false;
+}
+
// Routes
-app.get('/', (req, res) => {
+app.get('/', lightLimiter, (req, res) => {
res.sendFile(path.join(__dirname, 'public', 'index.html'));
});
@@ -104,7 +141,7 @@ app.get('/api/config', (req, res) => {
});
});
-app.post('/api/config', async (req, res) => {
+app.post('/api/config', analysisLimiter, async (req, res) => {
try {
// Update config with new values
config = { ...config, ...req.body };
@@ -119,22 +156,22 @@ app.post('/api/config', async (req, res) => {
});
// Image serving endpoint
-app.get('/api/image', async (req, res) => {
+app.get('/api/image', lightLimiter, async (req, res) => {
try {
- const { path: imagePath } = req.query;
+ const imagePath = req.query.path;
- if (!imagePath) {
+ if (!imagePath || typeof imagePath !== 'string') {
return res.status(400).json({ success: false, error: 'Image path is required' });
}
- // Check if file exists
- const exists = await fs.pathExists(imagePath);
- if (!exists) {
- return res.status(404).json({ success: false, error: 'Image not found' });
+ // Resolve then allowlist-check to prevent traversal (CWE-22)
+ const resolvedPath = path.resolve(imagePath);
+ if (!isAllowedPath(resolvedPath)) {
+ return res.status(400).json({ success: false, error: 'Invalid image path' });
}
- // Determine content type based on file extension
- const ext = path.extname(imagePath).toLowerCase();
+ // Only serve explicitly allowed image extensions โ no fallback to arbitrary files
+ const ext = path.extname(resolvedPath).toLowerCase();
const contentTypes = {
'.jpg': 'image/jpeg',
'.jpeg': 'image/jpeg',
@@ -145,11 +182,20 @@ app.get('/api/image', async (req, res) => {
'.tiff': 'image/tiff'
};
- const contentType = contentTypes[ext] || 'application/octet-stream';
+ const contentType = contentTypes[ext];
+ if (!contentType) {
+ return res.status(400).json({ success: false, error: 'File type not allowed' });
+ }
- // Set content type and send file
+ // Check if file exists
+ const exists = await fs.pathExists(resolvedPath);
+ if (!exists) {
+ return res.status(404).json({ success: false, error: 'Image not found' });
+ }
+
+ // Send file using absolute resolved path
res.setHeader('Content-Type', contentType);
- res.sendFile(imagePath);
+ res.sendFile(resolvedPath);
} catch (error) {
console.error('Error serving image:', error);
res.status(500).json({ success: false, error: error.message });
@@ -166,7 +212,7 @@ app.get('/api/favorites', (req, res) => {
}
});
-app.post('/api/favorites/add', async (req, res) => {
+app.post('/api/favorites/add', analysisLimiter, async (req, res) => {
try {
const { path: favPath, name } = req.body;
@@ -201,7 +247,7 @@ app.post('/api/favorites/add', async (req, res) => {
}
});
-app.post('/api/favorites/remove', async (req, res) => {
+app.post('/api/favorites/remove', analysisLimiter, async (req, res) => {
try {
const { path: favPath } = req.body;
@@ -243,11 +289,14 @@ app.get('/api/browse/drives', async (req, res) => {
app.get('/api/browse/directory', async (req, res) => {
try {
- const { path: directoryPath } = req.query;
-
- if (!directoryPath) {
+ const rawPath = req.query.path;
+ if (!rawPath || typeof rawPath !== 'string') {
return res.status(400).json({ success: false, error: 'Path parameter required' });
}
+ const directoryPath = path.resolve(rawPath);
+ if (!isAllowedPath(directoryPath)) {
+ return res.status(400).json({ success: false, error: 'Invalid path' });
+ }
const result = await DirectoryBrowser.getDirectoryContents(directoryPath);
@@ -309,13 +358,17 @@ app.post('/api/browse/create-directory', async (req, res) => {
}
});
-app.get('/api/browse/validate', async (req, res) => {
+app.get('/api/browse/validate', analysisLimiter, async (req, res) => {
try {
- const { path: directoryPath, checkMyWork } = req.query;
+ const { path: rawValidatePath, checkMyWork } = req.query;
- if (!directoryPath) {
+ if (!rawValidatePath || typeof rawValidatePath !== 'string') {
return res.status(400).json({ success: false, error: 'Path parameter required' });
}
+ const directoryPath = path.resolve(rawValidatePath);
+ if (!isAllowedPath(directoryPath)) {
+ return res.status(400).json({ success: false, error: 'Invalid path' });
+ }
const exists = await fs.pathExists(directoryPath);
let hasMyWork = false;
@@ -336,13 +389,16 @@ app.get('/api/browse/validate', async (req, res) => {
});
// File Analysis API Routes
-app.get('/api/analyze', async (req, res) => {
+app.get('/api/analyze', analysisLimiter, async (req, res) => {
try {
- const { path: directoryPath } = req.query;
-
- if (!directoryPath) {
+ const rawPath = req.query.path;
+ if (!rawPath || typeof rawPath !== 'string') {
return res.status(400).json({ success: false, error: 'Path parameter required' });
}
+ const directoryPath = path.resolve(rawPath);
+ if (!isAllowedPath(directoryPath)) {
+ return res.status(400).json({ success: false, error: 'Invalid path' });
+ }
console.log(`\n=== ANALYZE REQUEST ===`);
console.log(`Raw path from query: "${directoryPath}"`);
@@ -375,13 +431,16 @@ app.get('/api/analyze', async (req, res) => {
}
});
-app.get('/api/analyze/cleanup-suggestions', async (req, res) => {
+app.get('/api/analyze/cleanup-suggestions', analysisLimiter, async (req, res) => {
try {
- const { path: directoryPath } = req.query;
-
- if (!directoryPath) {
+ const rawPath = req.query.path;
+ if (!rawPath || typeof rawPath !== 'string') {
return res.status(400).json({ success: false, error: 'Path parameter required' });
}
+ const directoryPath = path.resolve(rawPath);
+ if (!isAllowedPath(directoryPath)) {
+ return res.status(400).json({ success: false, error: 'Invalid path' });
+ }
const analysisResult = await FileAnalyzer.analyzeDirectory(directoryPath);
@@ -447,11 +506,14 @@ app.post('/api/cleanup/subframe-directories', async (req, res) => {
app.get('/api/cleanup/subframe-info', async (req, res) => {
try {
- const { path: directoryPath } = req.query;
-
- if (!directoryPath) {
+ const rawPath = req.query.path;
+ if (!rawPath || typeof rawPath !== 'string') {
return res.status(400).json({ success: false, error: 'Path parameter required' });
}
+ const directoryPath = path.resolve(rawPath);
+ if (!isAllowedPath(directoryPath)) {
+ return res.status(400).json({ success: false, error: 'Invalid path' });
+ }
const analysisResult = await FileAnalyzer.analyzeDirectory(directoryPath);
@@ -473,15 +535,16 @@ app.get('/api/cleanup/subframe-info', async (req, res) => {
// Delete Session Files
app.post('/api/cleanup/session', async (req, res) => {
try {
- const { mainFolderPath, subFolderPath, mainFiles, subFiles } = req.body;
+ const { mainFolderPath, mainFiles, subFiles } = req.body;
if (!mainFolderPath || !mainFiles) {
return res.status(400).json({ success: false, error: 'mainFolderPath and mainFiles are required' });
}
+ // subFiles is an array of { folder, file } objects โ each entry carries its own
+ // folder path, supporting files from both _sub (Eq) and -sub (Alt/Az) directories.
const result = await FileCleanup.deleteSessionFiles({
mainFolderPath,
- subFolderPath,
mainFiles,
subFiles: subFiles || []
});
@@ -493,7 +556,7 @@ app.post('/api/cleanup/session', async (req, res) => {
});
// Import API Routes
-app.get('/api/import/detect-seestar', async (req, res) => {
+app.get('/api/import/detect-seestar', analysisLimiter, async (req, res) => {
try {
console.log('Detecting SeeStar devices...');
const devices = await importService.detectSeeStarDevices();
@@ -505,16 +568,22 @@ app.get('/api/import/detect-seestar', async (req, res) => {
}
});
-app.post('/api/import/validate-space', async (req, res) => {
+app.post('/api/import/validate-space', analysisLimiter, async (req, res) => {
try {
- const { sourcePath, destinationPath, strategy, subframeMode } = req.body;
-
- if (!sourcePath || !destinationPath) {
+ const { strategy, subframeMode } = req.body;
+ const rawSource = req.body.sourcePath;
+ const rawDest = req.body.destinationPath;
+ if (!rawSource || typeof rawSource !== 'string' || !rawDest || typeof rawDest !== 'string') {
return res.status(400).json({
success: false,
error: 'sourcePath and destinationPath required'
});
}
+ const sourcePath = path.resolve(rawSource);
+ const destinationPath = path.resolve(rawDest);
+ if (!isAllowedPath(sourcePath) || !isAllowedPath(destinationPath)) {
+ return res.status(400).json({ success: false, error: 'Invalid path' });
+ }
const importStrategy = strategy || 'full'; // Default to full if not specified
const importSubframeMode = subframeMode || 'all';
@@ -535,16 +604,23 @@ app.post('/api/import/validate-space', async (req, res) => {
}
});
-app.post('/api/import/start', async (req, res) => {
+app.post('/api/import/start', heavyOpLimiter, async (req, res) => {
try {
- const { sourcePath, destinationPath, strategy, socketId, subframeMode } = req.body;
-
- if (!sourcePath || !destinationPath || !strategy || !socketId) {
+ const { strategy, socketId, subframeMode } = req.body;
+ const rawSource = req.body.sourcePath;
+ const rawDest = req.body.destinationPath;
+ if (!rawSource || typeof rawSource !== 'string' || !rawDest || typeof rawDest !== 'string' ||
+ !strategy || !socketId) {
return res.status(400).json({
success: false,
error: 'sourcePath, destinationPath, strategy, and socketId required'
});
}
+ const sourcePath = path.resolve(rawSource);
+ const destinationPath = path.resolve(rawDest);
+ if (!isAllowedPath(sourcePath) || !isAllowedPath(destinationPath)) {
+ return res.status(400).json({ success: false, error: 'Invalid path' });
+ }
const importSubframeMode = subframeMode || 'all';
console.log(`Starting import: ${sourcePath} -> ${destinationPath} (${strategy}, ${importSubframeMode})`);
@@ -582,16 +658,23 @@ app.post('/api/import/cancel', async (req, res) => {
}
});
-app.post('/api/import/validate', async (req, res) => {
+app.post('/api/import/validate', analysisLimiter, async (req, res) => {
try {
- const { sourcePath, destinationPath, socketId, subframeMode = 'all' } = req.body;
-
- if (!sourcePath || !destinationPath || !socketId) {
+ const { socketId, subframeMode = 'all' } = req.body;
+ const rawSource = req.body.sourcePath;
+ const rawDest = req.body.destinationPath;
+ if (!rawSource || typeof rawSource !== 'string' || !rawDest || typeof rawDest !== 'string' ||
+ !socketId) {
return res.status(400).json({
success: false,
error: 'sourcePath, destinationPath, and socketId required'
});
}
+ const sourcePath = path.resolve(rawSource);
+ const destinationPath = path.resolve(rawDest);
+ if (!isAllowedPath(sourcePath) || !isAllowedPath(destinationPath)) {
+ return res.status(400).json({ success: false, error: 'Invalid path' });
+ }
const operationId = Date.now().toString();
console.log(`Starting transfer validation: ${sourcePath} -> ${destinationPath} (subframeMode: ${subframeMode})`);
@@ -613,23 +696,32 @@ app.post('/api/import/validate', async (req, res) => {
});
// Merge API Routes
-app.post('/api/merge/analyze', async (req, res) => {
+app.post('/api/merge/analyze', analysisLimiter, async (req, res) => {
try {
- const { sourcePaths, destinationPath, socketId, subframeMode } = req.body;
-
- if (!sourcePaths || !Array.isArray(sourcePaths) || sourcePaths.length < 2) {
+ const { socketId, subframeMode } = req.body;
+ const sourcePaths = (Array.isArray(req.body.sourcePaths) ? req.body.sourcePaths : [])
+ .filter(p => p && typeof p === 'string')
+ .map(p => path.resolve(p))
+ .filter(p => isAllowedPath(p));
+ const rawDest = req.body.destinationPath;
+
+ if (!sourcePaths.length || sourcePaths.length < 2) {
return res.status(400).json({
success: false,
error: 'At least 2 source paths required'
});
}
- if (!destinationPath) {
+ if (!rawDest || typeof rawDest !== 'string') {
return res.status(400).json({
success: false,
error: 'destinationPath required'
});
}
+ const destinationPath = path.resolve(rawDest);
+ if (!isAllowedPath(destinationPath)) {
+ return res.status(400).json({ success: false, error: 'Invalid destinationPath' });
+ }
const mergeSubframeMode = subframeMode || 'all';
console.log(`Analyzing ${sourcePaths.length} libraries for merge (${mergeSubframeMode})...`);
@@ -642,16 +734,24 @@ app.post('/api/merge/analyze', async (req, res) => {
}
});
-app.post('/api/merge/validate-space', async (req, res) => {
+app.post('/api/merge/validate-space', analysisLimiter, async (req, res) => {
try {
- const { sourcePaths, destinationPath, subframeMode } = req.body;
-
- if (!sourcePaths || !destinationPath) {
+ const { subframeMode } = req.body;
+ const sourcePaths = (Array.isArray(req.body.sourcePaths) ? req.body.sourcePaths : [])
+ .filter(p => typeof p === 'string')
+ .map(p => path.resolve(p))
+ .filter(p => isAllowedPath(p));
+ const rawDest = req.body.destinationPath;
+ if (!sourcePaths.length || !rawDest || typeof rawDest !== 'string') {
return res.status(400).json({
success: false,
error: 'sourcePaths and destinationPath required'
});
}
+ const destinationPath = path.resolve(rawDest);
+ if (!isAllowedPath(destinationPath)) {
+ return res.status(400).json({ success: false, error: 'Invalid destinationPath' });
+ }
const mergeSubframeMode = subframeMode || 'all';
console.log(`Validating disk space for merge: ${sourcePaths.length} sources (${mergeSubframeMode})`);
@@ -682,19 +782,44 @@ app.post('/api/merge/validate-space', async (req, res) => {
}
});
-app.post('/api/merge/start', async (req, res) => {
+app.post('/api/merge/start', heavyOpLimiter, async (req, res) => {
try {
- const { sourcePaths, destinationPath, mergePlan, socketId } = req.body;
-
- if (!sourcePaths || !destinationPath || !mergePlan || !socketId) {
+ const { mergePlan, socketId } = req.body;
+ const sourcePaths = (Array.isArray(req.body.sourcePaths) ? req.body.sourcePaths : [])
+ .filter(p => p && typeof p === 'string')
+ .map(p => path.resolve(p))
+ .filter(p => isAllowedPath(p));
+ const rawDest = req.body.destinationPath;
+
+ if (!sourcePaths.length || !rawDest || typeof rawDest !== 'string' ||
+ !mergePlan || !socketId) {
return res.status(400).json({
success: false,
error: 'sourcePaths, destinationPath, mergePlan, and socketId required'
});
}
+ const destinationPath = path.resolve(rawDest);
+ if (!isAllowedPath(destinationPath)) {
+ return res.status(400).json({ success: false, error: 'Invalid destinationPath' });
+ }
console.log(`Starting merge: ${sourcePaths.length} sources -> ${destinationPath}`);
+ // Sanitize paths nested inside mergePlan.filesToCopy (CWE-22).
+ // sourcePath must resolve to a recognised Windows root; relativePath must not
+ // contain traversal sequences (it is joined with destinationPath server-side).
+ if (Array.isArray(mergePlan.filesToCopy)) {
+ mergePlan.filesToCopy = mergePlan.filesToCopy.map(item => {
+ if (!item.sourcePath || typeof item.sourcePath !== 'string') return null;
+ const resolvedSource = path.resolve(item.sourcePath);
+ if (!isAllowedPath(resolvedSource)) return null;
+ if (item.relativePath !== undefined) {
+ if (typeof item.relativePath !== 'string' || item.relativePath.includes('..')) return null;
+ }
+ return { ...item, sourcePath: resolvedSource };
+ }).filter(Boolean);
+ }
+
const operationId = Date.now().toString();
mergeService.executeMerge(sourcePaths, destinationPath, mergePlan, socketId, operationId)
.then(() => {
@@ -726,16 +851,20 @@ app.post('/api/merge/cancel', async (req, res) => {
}
});
-app.post('/api/merge/validate', async (req, res) => {
+app.post('/api/merge/validate', analysisLimiter, async (req, res) => {
try {
- const { destinationPath, mergePlan, socketId } = req.body;
-
- if (!destinationPath || !mergePlan || !socketId) {
+ const { mergePlan, socketId } = req.body;
+ const rawDest = req.body.destinationPath;
+ if (!rawDest || typeof rawDest !== 'string' || !mergePlan || !socketId) {
return res.status(400).json({
success: false,
error: 'destinationPath, mergePlan, and socketId required'
});
}
+ const destinationPath = path.resolve(rawDest);
+ if (!isAllowedPath(destinationPath)) {
+ return res.status(400).json({ success: false, error: 'Invalid destinationPath' });
+ }
const operationId = Date.now().toString();
console.log(`Starting merge validation: ${destinationPath}`);
@@ -759,14 +888,18 @@ app.post('/api/merge/validate', async (req, res) => {
// โโโ Object Rename โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
app.post('/api/rename-object', async (req, res) => {
try {
- const { libraryPath, fromName, toName } = req.body;
-
- if (!libraryPath || !fromName || !toName) {
+ const { fromName, toName } = req.body;
+ const rawLib = req.body.libraryPath;
+ if (!rawLib || typeof rawLib !== 'string' || !fromName || !toName) {
return res.status(400).json({
success: false,
error: 'libraryPath, fromName and toName are required'
});
}
+ const libraryPath = path.resolve(rawLib);
+ if (!isAllowedPath(libraryPath)) {
+ return res.status(400).json({ success: false, error: 'Invalid libraryPath' });
+ }
console.log(`Renaming object: "${fromName}" โ "${toName}" in ${libraryPath}`);
const result = await FileRenamer.renameObject(libraryPath, fromName, toName);
diff --git a/src/services/catalogParser.js b/src/services/catalogParser.js
index 79281e9..e08a165 100644
--- a/src/services/catalogParser.js
+++ b/src/services/catalogParser.js
@@ -10,21 +10,35 @@ class CatalogParser {
* @returns {Object} Parsed object information
*/
static parseObjectName(folderName) {
- // Remove _sub suffix if present
- const isSubFolder = folderName.endsWith('_sub');
- const baseName = isSubFolder ? folderName.replace(/_sub$/, '') : folderName;
+ // Detect sub-frame folder by suffix:
+ // _sub โ Eq mount mode
+ // -sub โ Alt/Az mount mode
+ const isSubFolderEq = folderName.endsWith('_sub');
+ const isSubFolderAltAz = !isSubFolderEq && folderName.endsWith('-sub');
+ const isSubFolder = isSubFolderEq || isSubFolderAltAz;
+
+ let baseName = folderName;
+ let mountMode = null;
+ if (isSubFolderEq) {
+ baseName = folderName.slice(0, -4); // strip '_sub' (4 chars)
+ mountMode = 'eq';
+ } else if (isSubFolderAltAz) {
+ baseName = folderName.slice(0, -4); // strip '-sub' (4 chars)
+ mountMode = 'altaz';
+ }
// Extract catalog type and details
const catalogInfo = this.identifyCatalog(baseName);
return {
- originalName: folderName,
- baseName: baseName,
- isSubFolder: isSubFolder,
- catalog: catalogInfo.catalog,
+ originalName: folderName,
+ baseName: baseName,
+ isSubFolder: isSubFolder,
+ mountMode: mountMode, // 'eq' | 'altaz' | null
+ catalog: catalogInfo.catalog,
catalogNumber: catalogInfo.number,
- displayName: catalogInfo.displayName,
- variant: catalogInfo.variant
+ displayName: catalogInfo.displayName,
+ variant: catalogInfo.variant
};
}
@@ -104,7 +118,7 @@ class CatalogParser {
* @returns {boolean}
*/
static isSubFrameFolder(folderName) {
- return folderName.endsWith('_sub');
+ return folderName.endsWith('_sub') || folderName.endsWith('-sub');
}
/**
@@ -113,7 +127,10 @@ class CatalogParser {
* @returns {string}
*/
static getBaseName(folderName) {
- return folderName.replace(/_sub$/, '');
+ if (folderName.endsWith('_sub') || folderName.endsWith('-sub')) {
+ return folderName.slice(0, -4);
+ }
+ return folderName;
}
/**
diff --git a/src/services/fileAnalyzer.js b/src/services/fileAnalyzer.js
index d661c5f..ef8765f 100644
--- a/src/services/fileAnalyzer.js
+++ b/src/services/fileAnalyzer.js
@@ -83,6 +83,7 @@ class FileAnalyzer {
catalogNumber: parsed.catalogNumber,
variant: parsed.variant,
hasSubFrames: false,
+ mountMode: null, // 'eq' | 'altaz' | 'both'
isMosaic: CatalogParser.isMosaic(item),
mainFolder: {
path: itemPath,
@@ -90,7 +91,9 @@ class FileAnalyzer {
fileCount: 0,
size: 0
},
- subFolder: null,
+ subFolderEq: null, // _sub (Eq mount mode)
+ subFolderAltAz: null, // -sub (Alt/Az mount mode)
+ subFolder: null, // backward-compat alias
dates: [],
stackingCounts: [],
exposures: [],
@@ -126,14 +129,32 @@ class FileAnalyzer {
if (parsed.isSubFolder && objects.has(parsed.baseName)) {
const objectData = objects.get(parsed.baseName);
objectData.hasSubFrames = true;
- objectData.subFolder = {
+
+ const subData = {
path: itemPath,
files: [],
fileCount: 0,
size: 0
};
- await this.scanFolderFiles(itemPath, objectData.subFolder, objectData);
+ if (parsed.mountMode === 'eq') {
+ objectData.subFolderEq = subData;
+ } else {
+ objectData.subFolderAltAz = subData;
+ }
+
+ // Keep mountMode on the object: first seen sets it, second of a
+ // different type upgrades it to 'both'.
+ if (objectData.mountMode === null) {
+ objectData.mountMode = parsed.mountMode;
+ } else if (objectData.mountMode !== parsed.mountMode) {
+ objectData.mountMode = 'both';
+ }
+
+ // Backward-compat alias: prefer Eq folder when both exist.
+ objectData.subFolder = objectData.subFolderEq || objectData.subFolderAltAz;
+
+ await this.scanFolderFiles(itemPath, subData, objectData);
}
} catch (error) {
console.warn(`Error processing sub-folder ${item}:`, error.message);
@@ -155,22 +176,20 @@ class FileAnalyzer {
totalFiles += obj.mainFolder.fileCount;
totalSize += obj.mainFolder.size;
- if (obj.subFolder) {
- totalFiles += obj.subFolder.fileCount;
- totalSize += obj.subFolder.size;
- }
-
// File type counts
fitCount += obj.mainFolder.files.filter(f => f.endsWith('.fit')).length;
jpgCount += obj.mainFolder.files.filter(f => f.endsWith('.jpg')).length;
thnCount += obj.mainFolder.files.filter(f => f.endsWith('_thn.jpg')).length;
mp4Count += obj.mainFolder.files.filter(f => f.endsWith('.mp4')).length;
- if (obj.subFolder) {
- fitCount += obj.subFolder.files.filter(f => f.endsWith('.fit')).length;
- jpgCount += obj.subFolder.files.filter(f => f.endsWith('.jpg')).length;
- thnCount += obj.subFolder.files.filter(f => f.endsWith('_thn.jpg')).length;
- mp4Count += obj.subFolder.files.filter(f => f.endsWith('.mp4')).length;
+ // Include both sub-folders (Eq and Alt/Az) in all totals
+ for (const sf of [obj.subFolderEq, obj.subFolderAltAz].filter(Boolean)) {
+ totalFiles += sf.fileCount;
+ totalSize += sf.size;
+ fitCount += sf.files.filter(f => f.endsWith('.fit')).length;
+ jpgCount += sf.files.filter(f => f.endsWith('.jpg')).length;
+ thnCount += sf.files.filter(f => f.endsWith('_thn.jpg')).length;
+ mp4Count += sf.files.filter(f => f.endsWith('.mp4')).length;
}
// Date range
diff --git a/src/services/fileCleanup.js b/src/services/fileCleanup.js
index 4e0e5b5..23e7118 100644
--- a/src/services/fileCleanup.js
+++ b/src/services/fileCleanup.js
@@ -77,61 +77,67 @@ class FileCleanup {
};
for (const obj of objects) {
- // Skip objects without sub-frames
- if (!obj.subFolder) continue;
+ // Collect all sub-folders for this object (Eq and/or Alt/Az)
+ const subFolders = [obj.subFolderEq, obj.subFolderAltAz].filter(Boolean);
+ // Fallback for legacy data that only has subFolder set
+ if (subFolders.length === 0 && obj.subFolder) subFolders.push(obj.subFolder);
- results.totalObjects++;
-
- const objectResult = {
- name: obj.displayName,
- path: obj.subFolder.path,
- filesDeleted: 0,
- spaceFreed: 0,
- deletedFiles: []
- };
-
- try {
- const files = await fs.readdir(obj.subFolder.path);
+ if (subFolders.length === 0) continue;
- for (const file of files) {
- const filePath = path.join(obj.subFolder.path, file);
-
- try {
- // Only delete files that are NOT .fit files
- if (!file.endsWith('.fit')) {
- const stats = await fs.stat(filePath);
- const fileSize = stats.size;
+ results.totalObjects++;
- await fs.remove(filePath);
+ for (const sf of subFolders) {
+ const objectResult = {
+ name: obj.displayName,
+ path: sf.path,
+ filesDeleted: 0,
+ spaceFreed: 0,
+ deletedFiles: []
+ };
- objectResult.filesDeleted++;
- objectResult.spaceFreed += fileSize;
- objectResult.deletedFiles.push({
- name: file,
- size: fileSize
+ try {
+ const files = await fs.readdir(sf.path);
+
+ for (const file of files) {
+ const filePath = path.join(sf.path, file);
+
+ try {
+ // Only delete files that are NOT .fit files
+ if (!file.endsWith('.fit')) {
+ const stats = await fs.stat(filePath);
+ const fileSize = stats.size;
+
+ await fs.remove(filePath);
+
+ objectResult.filesDeleted++;
+ objectResult.spaceFreed += fileSize;
+ objectResult.deletedFiles.push({
+ name: file,
+ size: fileSize
+ });
+ }
+ } catch (error) {
+ results.errors.push({
+ object: obj.displayName,
+ file: file,
+ error: error.message
});
}
- } catch (error) {
- results.errors.push({
- object: obj.displayName,
- file: file,
- error: error.message
- });
}
- }
- if (objectResult.filesDeleted > 0) {
- results.cleaned.push(objectResult);
- results.totalFilesDeleted += objectResult.filesDeleted;
- results.totalSpaceFreed += objectResult.spaceFreed;
- }
+ if (objectResult.filesDeleted > 0) {
+ results.cleaned.push(objectResult);
+ results.totalFilesDeleted += objectResult.filesDeleted;
+ results.totalSpaceFreed += objectResult.spaceFreed;
+ }
- } catch (error) {
- results.failed.push({
- name: obj.displayName,
- path: obj.subFolder.path,
- reason: error.message
- });
+ } catch (error) {
+ results.failed.push({
+ name: obj.displayName,
+ path: sf.path,
+ reason: error.message
+ });
+ }
}
}
@@ -156,22 +162,25 @@ class FileCleanup {
};
for (const obj of objects) {
- if (!obj.subFolder) continue;
+ const subFolders = [obj.subFolderEq, obj.subFolderAltAz].filter(Boolean);
+ if (subFolders.length === 0 && obj.subFolder) subFolders.push(obj.subFolder);
- info.objectsWithSubFrames++;
+ if (subFolders.length === 0) continue;
- const nonFitFiles = obj.subFolder.files.filter(f => !f.endsWith('.fit'));
+ info.objectsWithSubFrames++;
- if (nonFitFiles.length > 0) {
- const detail = {
- name: obj.displayName,
- path: obj.subFolder.path,
- nonFitFileCount: nonFitFiles.length,
- files: nonFitFiles
- };
+ for (const sf of subFolders) {
+ const nonFitFiles = sf.files.filter(f => !f.endsWith('.fit'));
- info.details.push(detail);
- info.totalNonFitFiles += nonFitFiles.length;
+ if (nonFitFiles.length > 0) {
+ info.details.push({
+ name: obj.displayName,
+ path: sf.path,
+ nonFitFileCount: nonFitFiles.length,
+ files: nonFitFiles
+ });
+ info.totalNonFitFiles += nonFitFiles.length;
+ }
}
}
@@ -182,12 +191,12 @@ class FileCleanup {
* Delete all files belonging to a specific imaging session
* @param {Object} params
* @param {string} params.mainFolderPath - Full path to the main object folder
- * @param {string} [params.subFolderPath] - Full path to the _sub folder (optional)
* @param {string[]} params.mainFiles - Filenames (not paths) in main folder to delete
- * @param {string[]} params.subFiles - Filenames (not paths) in sub folder to delete
+ * @param {Array<{folder:string,file:string}>} params.subFiles - Sub-frame files with their
+ * own folder paths (supports files from multiple sub-folders: _sub and/or -sub)
* @returns {Promise} Results of deletion
*/
- static async deleteSessionFiles({ mainFolderPath, subFolderPath, mainFiles = [], subFiles = [] }) {
+ static async deleteSessionFiles({ mainFolderPath, mainFiles = [], subFiles = [] }) {
const results = {
success: true,
filesDeleted: 0,
@@ -197,7 +206,7 @@ class FileCleanup {
const deleteList = [
...mainFiles.map(f => ({ folder: mainFolderPath, file: f })),
- ...subFiles.map(f => ({ folder: subFolderPath, file: f }))
+ ...subFiles // already { folder, file } objects
];
for (const { folder, file } of deleteList) {
diff --git a/src/services/importService.js b/src/services/importService.js
index 8466faa..be3f003 100644
--- a/src/services/importService.js
+++ b/src/services/importService.js
@@ -94,7 +94,8 @@ class ImportService {
const parts = relativePath.replace(/\\/g, '/').split('/');
for (let i = 0; i < parts.length - 1; i++) {
- if (parts[i].toLowerCase().endsWith('_sub')) {
+ const d = parts[i].toLowerCase();
+ if (d.endsWith('_sub') || d.endsWith('-sub')) {
return true;
}
}
diff --git a/src/services/mergeService.js b/src/services/mergeService.js
index daa9e5d..7e8b0a8 100644
--- a/src/services/mergeService.js
+++ b/src/services/mergeService.js
@@ -31,7 +31,8 @@ class MergeService {
const parts = relativePath.replace(/\\/g, '/').split('/');
for (let i = 0; i < parts.length - 1; i++) {
- if (parts[i].toLowerCase().endsWith('_sub')) {
+ const d = parts[i].toLowerCase();
+ if (d.endsWith('_sub') || d.endsWith('-sub')) {
return true;
}
}
@@ -499,7 +500,7 @@ class MergeService {
return { success: false, cancelled: true };
}
- const destPath = path.join(destinationPath, file.relativePath);
+ const destPath = path.resolve(destinationPath, file.relativePath);
try {
// Ensure destination directory exists
@@ -676,7 +677,7 @@ class MergeService {
try {
for (const file of filesToValidate) {
- const destPath = path.join(destinationPath, file.relativePath);
+ const destPath = path.resolve(destinationPath, file.relativePath);
try {
// Check if file exists
diff --git a/src/utils/diskSpaceValidator.js b/src/utils/diskSpaceValidator.js
index a0e4134..2ed789c 100644
--- a/src/utils/diskSpaceValidator.js
+++ b/src/utils/diskSpaceValidator.js
@@ -17,7 +17,8 @@ class DiskSpaceValidator {
const parts = relativePath.replace(/\\/g, '/').split('/');
for (let i = 0; i < parts.length - 1; i++) {
- if (parts[i].toLowerCase().endsWith('_sub')) {
+ const d = parts[i].toLowerCase();
+ if (d.endsWith('_sub') || d.endsWith('-sub')) {
return true;
}
}