From c4c6e3af5d71b01373d320aa1203866a9f89106e Mon Sep 17 00:00:00 2001 From: Khushi Kakade Date: Sat, 18 Jul 2026 15:18:46 +0530 Subject: [PATCH] fix: delete uploaded temp file after processing in syllabus upload route MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Uploaded files in /api/syllabus/upload were never removed from disk after processing, causing unbounded storage growth and leaving user files permanently accessible via the static /uploads route. Added a finally block to fs.unlink() the temp file on every request path — both successful responses and error cases. Fixes #679 --- server/index.js | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/server/index.js b/server/index.js index 45212ae..729e658 100644 --- a/server/index.js +++ b/server/index.js @@ -203,6 +203,14 @@ app.post('/api/syllabus/upload', upload.single('file'), async (req, res) => { console.error('Syllabus upload error:', error); if (error.message && error.message.includes('Invalid file type')) return res.status(400).json({ error: 'Invalid file format. Allowed: pdf, docx, txt' }); res.status(500).json({ error: 'Failed to process file', details: error.message }); + } finally { + // Always clean up the uploaded temp file after processing (success or failure) + // to prevent unbounded disk growth and unintended file retention. + if (req.file && req.file.path) { + fs.unlink(req.file.path, (err) => { + if (err) console.error('Failed to delete uploaded temp file:', err); + }); + } } });