From f0b9ca4e2c257cf4b1d49fae2931925cc225c059 Mon Sep 17 00:00:00 2001
From: Jesse Chan <jc@linux.com>
Date: Sun, 6 Dec 2020 21:49:40 +0800
Subject: [PATCH] server: torrents: handle no content and access denied cases
 in download

---
 server/routes/api/torrents.ts | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/server/routes/api/torrents.ts b/server/routes/api/torrents.ts
index 65ecd337..0e3a2ea1 100644
--- a/server/routes/api/torrents.ts
+++ b/server/routes/api/torrents.ts
@@ -541,7 +541,9 @@ router.get('/:hash/contents/:indices/data', (req, res) => {
     if (!selectedTorrent) return res.status(404).json({error: 'Torrent not found.'});
 
     return req.services?.clientGatewayService?.getTorrentContents(hash).then((contents) => {
-      if (!contents) return res.status(404).json({error: 'Torrent contents not found'});
+      if (!contents || contents.length < 1) {
+        return res.status(404).json({error: 'Torrent contents not found'});
+      }
 
       let indices: Array<number>;
       if (!stringIndices || stringIndices === 'all') {
@@ -557,6 +559,10 @@ router.get('/:hash/contents/:indices/data', (req, res) => {
         })
         .filter((filePath) => isAllowedPath(filePath));
 
+      if (filePathsToDownload.length < 1) {
+        return res.status(403).json(accessDeniedError());
+      }
+
       if (filePathsToDownload.length === 1) {
         const file = filePathsToDownload[0];
         if (!fs.existsSync(file)) return res.status(404).json({error: 'File not found.'});