From 917a8faca636504e207c49d346ab374f45c1d529 Mon Sep 17 00:00:00 2001
From: Luke Berndt <lukekb@gmail.com>
Date: Mon, 9 Nov 2026 18:26:15 -0500
Subject: [PATCH] Remove upload temp files on every exit path

Rejected uploads (unknown system, bad key, invalid file or source list) and
uploads that threw returned without deleting multer's temp file, leaking
751k files (39 GB) in the backend container since April.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 backend/controllers/uploads.js | 20 +++++++++-----------
 1 file changed, 9 insertions(+), 11 deletions(-)

diff --git a/backend/controllers/uploads.js b/backend/controllers/uploads.js
index d7f0a7a..f99771a 100644
--- a/backend/controllers/uploads.js
+++ b/backend/controllers/uploads.js
@@ -162,11 +162,6 @@ exports.upload = async function (req, res, next) {
       });
 
       if (!talkgroupExists) {
-        try {
-          fs.unlinkSync(req.file.path);
-        } catch (err) {
-          console.error(`[${call.shortName}] error deleting: ${req.file.path}`);
-        }
         res.status(500).send("Talkgroup does not exist, skipping.\n");
         return;
       }
@@ -233,16 +228,19 @@ exports.upload = async function (req, res, next) {
       next();
     }
 
-    try {
-      fs.unlinkSync(req.file.path);
-    } catch (err) {
-      console.warn("There was an Error deleting: " + req.file.path);
-    }
-    cleanupTime = Date.now();
     //console.log(`[${call.shortName}] \t Verify System: ${validateSystemTime - start_time}  \t Read file: ${readFileTime - validateSystemTime} \t Upload: ${ uploadFileTime - validateSystemTime} \t Save: ${saveCallTime - uploadFileTime} \tStats: ${statsTime - saveCallTime}\tCleanup: ${cleanupTime - statsTime} \t\t Total: ${cleanupTime - start_time}`);
   } catch (error) {
     console.error("Error processing call upload: " + error);
   } finally {
+    // multer has already written the temp file, so remove it on every exit path.
+    if (req.file) {
+      try {
+        fs.unlinkSync(req.file.path);
+      } catch (err) {
+        console.warn("There was an Error deleting: " + req.file.path);
+      }
+    }
+    cleanupTime = Date.now();
     const totalTime = Date.now() - start_time;
     if (totalTime > 10000) {
       console.warn(`[${req.params.shortName}] Slow Upload - Size: ${call.len} Verify System: ${validateSystemTime - start_time}  Read file: ${readFileTime - validateSystemTime} Upload: ${ uploadFileTime - validateSystemTime} Save: ${saveCallTime - uploadFileTime} Stats: ${statsTime - saveCallTime} Cleanup: ${cleanupTime - statsTime} Total: ${totalTime}`);