Merge branch 'staging' of github.com:cryptpad/cryptpad into staging

SECURITY.md

@@ -6,6 +6,8 @@ SPDX-License-Identifier: AGPL-3.0-or-later
 
 # Security Policy
 
+CryptPad security policy is detailed in the following document: https://cryptpad.org/security/.
+
 ## Supported Versions
 
 Considering the amount of resources necessary to backport security or bug fixes to previous, unsupported CryptPad versions, it's not something we do.
@@ -13,7 +15,7 @@ However, we quickly release new minor versions in case of need.
 
 Please keep up with the latest release published here: https://github.com/cryptpad/cryptpad/releases
 
-Note that every GitHub release page has an RSS compatible feed that you can subscribe on to be informed of every new release.
+Note that every GitHub release page has an [RSS compatible feed](https://github.com/cryptpad/cryptpad/releases.atom) that you can subscribe on to be informed of every new release.
 
 We do also communicate about this topic on:
 - [Our blog](https://blog.cryptpad.org)

lib/storage/blob.js

@@ -664,6 +664,8 @@ var listBlobs = function (root, handler, fast, cb) {
                 var nestedDirPath = Path.join(root, dir);
                 Fs.readdir(nestedDirPath, w(function (err, list) {
                     if (err) { return void handler(err); } // Is this correct?
+
+                    const s = new Set(list);
                     list.forEach(function (item) {
                         // ignore hidden files
                         if (/^\./.test(item)) { return; }
@@ -677,7 +679,7 @@ var listBlobs = function (root, handler, fast, cb) {
                         if (!/^[0-9a-fA-F]{48}$/.test(item)) {
                             blobName = item.replace(/\.metadata\.ndjson/, '');
                             // check if blob already exists
-                            if (list.indexOf(blobName) !== -1) { return; }
+                            if (s.has(blobName)) { return; }
                             // otherwise set a flag indicating that we should
                             // handle the metadata on its own
                             isLonelyMetadata = true;

lib/storage/file.js

@@ -790,6 +790,7 @@ var listChannels = function (root, handler, cb, fast) {
                 Fs.readdir(nestedDirPath, w(function (err, list) {
                     if (err) { return void handler(err); } // Is this correct?
 
+                    const s = new Set(list);
                     list.forEach(function (item) {
                         // ignore hidden files
                         if (/^\./.test(item)) { return; }
@@ -808,7 +809,7 @@ var listChannels = function (root, handler, cb, fast) {
 
                             // if there is a corresponding channel present in the list,
                             // then we should stop here and handle everything when we get to the channel
-                            if (list.indexOf(channelName) !== -1) { return; }
+                            if (s.has(channelName)) { return; }
                             // otherwise set a flag indicating that we should
                             // handle the metadata on its own
                             isLonelyMetadata = true;