full

controllers/application/tickets/ticketsController.js

@@ -4,6 +4,7 @@ const TicketMessageModel = require('../../../models/TicketMessageModel')
 const jMoment = require('moment-jalaali')
 const path = require('path')
 const fs = require('fs-extra')
+const crypto = require('crypto')
 
 const getUserTickets = async (req, res) => {
   try {
@@ -82,7 +83,8 @@ const addUserMessageToTicket = async (req, res) => {
         fs.mkdirSync(uploadDir, { recursive: true })
       }
 
-      const uniqueFileName = `${Date.now()}-${file.name}`
+      // اسمِ فایل هیچ‌وقت مستقیم از ورودیِ کاربر (file.name) گرفته نمی‌شه — فقط پسوندش
+      const uniqueFileName = `${Date.now()}-${crypto.randomUUID()}${path.extname(file.name || '')}`
       const filePath = path.join(uploadDir, uniqueFileName)
       await fs.move(file.path, filePath)