Add browser security headers, implement upload temp directory management, and enhance SSE handling.

src/routes/uploads.js

@@ -2,6 +2,8 @@
  * @file Verarbeitet das Hochladen, Abrufen und Entfernen von Bildanhängen mit Zugriffskontrolle.
  */
 import express from "express";
+import {mkdirSync} from "node:fs";
+import {unlink} from "node:fs/promises";
 import {asyncHandler} from "../middleware/asyncHandler.js";
 import multer from "multer";
 import {requireLogin} from "../middleware/auth.js";
@@ -9,8 +11,9 @@ import {AttachmentError} from "../services/attachmentService.js";
 
 export function createUploadsRouter(service, config) {
     const router = express.Router();
+    mkdirSync(config.uploadTmpDir, {recursive: true});
     const activeUploads = new Map();
-    const upload = multer({storage: multer.memoryStorage(), limits: {
+    const upload = multer({storage: multer.diskStorage({destination: config.uploadTmpDir}), limits: {
         fileSize: config.uploadMaxSizeMb * 1024 * 1024, files: 1, fields: 0, parts: 1
     }}).single("image");
     const fail = (res, error) => res.status(error instanceof AttachmentError ? error.status : 500).json({error:
@@ -26,8 +29,9 @@ export function createUploadsRouter(service, config) {
             if (remaining) activeUploads.set(user, remaining); else activeUploads.delete(user);
         });
         upload(req, res, async error => {
-            if (error) return res.status(error.code === "LIMIT_FILE_SIZE" ? 413 : 400).json({error:
+            if (error) { if (req.file?.path) await unlink(req.file.path).catch(() => {}); return res.status(error.code === "LIMIT_FILE_SIZE" ? 413 : 400).json({error:
                 error.code === "LIMIT_FILE_SIZE" ? `Image exceeds ${config.uploadMaxSizeMb} MB` : "Upload one PNG, JPEG or WebP image per request"});
+            }
             try { res.status(201).json(await service.upload(req.file, req.session.user)); }
             catch (failure) { fail(res, failure); }
         });