From 1ba3b271ea9a6113fed08499d892341fa9d94e09 Mon Sep 17 00:00:00 2001
From: nbitzz <77242831+nbitzz@users.noreply.github.com>
Date: Thu, 26 Jan 2023 22:01:47 -0800
Subject: [PATCH] 1.2.3

---
 README.md    |  5 +++--
 package.json |  2 +-
 src/index.ts | 14 ++++++++++++--
 3 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index 133ee03..d6602e9 100644
--- a/README.md
+++ b/README.md
@@ -20,8 +20,9 @@ TOKEN=KILL-YOURSELF.NOW
 - [X] 1.2.0 add file parameters section + custom ids
 - [X] 1.2.1 add file counter to main page
 - [X] 1.2.2 clean up this shitty code
-- [ ] 1.2.3 add id locks, allowing you to set a key for a file that allows you to overwrite the file in the future
-- [ ] 1.2.4 prevent cloning of local/private ip addresses
+- [X] 1.2.3 bugfixes
+- [ ] 1.2.4 add id locks, allowing you to set a key for a file that allows you to overwrite the file in the future
+- [ ] 1.2.5 prevent cloning of local/private ip addresses
 - [ ] 1.3.0 add simple moderation tools
 - [ ] 2.0.0 rewrite using theUnfunny's code as a base/rewrite using monofile-core
 
diff --git a/package.json b/package.json
index 00db82e..f3ccbe8 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "monofile",
-  "version": "1.2.2",
+  "version": "1.2.3",
   "description": "Discord-based file sharing",
   "main": "index.js",
   "scripts": {
diff --git a/src/index.ts b/src/index.ts
index 782dd9b..5d32061 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -106,7 +106,7 @@ app.post("/clone",(req,res) => {
             res.send("[err] invalid url")
         }
         axios.get(j.url,{responseType:"arraybuffer"}).then((data:AxiosResponse) => {
-            files.uploadFile({name:req.body.split("/")[req.body.split("/").length-1] || "generic",mime:data.headers["content-type"],uploadId:j.uploadId},Buffer.from(data.data))
+            files.uploadFile({name:j.url.split("/")[req.body.split("/").length-1] || "generic",mime:data.headers["content-type"],uploadId:j.uploadId},Buffer.from(data.data))
                 .then((uID) => res.send(uID))
                 .catch((stat) => {res.status(stat.status);res.send(`[err] ${stat.message}`)})
         }).catch((err) => {
@@ -128,7 +128,17 @@ app.get("/download/:fileId",(req,res) => {
 
         fs.readFile(__dirname+"/../pages/download.html",(err,buf) => {
             if (err) {res.sendStatus(500);console.log(err);return}
-            res.send(buf.toString().replace(/\$FileId/g,req.params.fileId).replace(/\$Version/g,pkg.version).replace(/\$FileName/g,file.filename))
+            res.send(
+                buf.toString()
+                .replace(/\$FileId/g,req.params.fileId)
+                .replace(/\$Version/g,pkg.version)
+                .replace(/\$FileName/g,
+                    file.filename
+                        .replace(/\&/g,"&amp;")
+                        .replace(/\</g,"&lt;")
+                        .replace(/\>/g,"&gt;")
+                )
+            )
         })
     } else {
         ThrowError(res,404,"File not found.")