Security Vulnerability: unauthorized upload behaviour

[Nictheboy]

Currently, the backend accepts uploaded file, regardless of its type, and even if there is not a token. This is extremely dangerous!

nictheboy@laptop:/tmp$ rm -r /tmp/app/*
nictheboy@laptop:/tmp$ tree /tmp/app/
/tmp/app/

0 directories, 0 files
nictheboy@laptop:/tmp$ curl -X POST http://localhost:3000/avatars -F "avatar=@bugfile;type=image/gif" && echo ""
{"code":201,"message":"Upload avatar successfully","data":{"avatarId":21}}
nictheboy@laptop:/tmp$ curl -X POST http://localhost:3000/materials -F "type=file" -F "file=@bugfile" && echo ""
{"code":401,"message":"AuthenticationRequiredError: Authentication required"}
nictheboy@laptop:/tmp$ curl -X POST http://localhost:3000/attachments -F "type=file" -F "file=@bugfile" && echo ""
{"code":401,"message":"AuthenticationRequiredError: Authentication required"}
nictheboy@laptop:/tmp$ tree /tmp/app/
/tmp/app/
└── uploads
    ├── avatars
    │   └── fd6bf3d1-0d88-4f83-a080-a95b1d62dfb7
    └── files
        ├── 0f9be690-4133-4d34-a25a-d293308ed297
        └── b7d8e04a-3a15-4688-ba24-13bfb3ebd037

4 directories, 3 files
nictheboy@laptop:/tmp$ cat app/uploads/avatars/fd6bf3d1-0d88-4f83-a080-a95b1d62dfb7 
BUG!
nictheboy@laptop:/tmp$ cat app/uploads/files/0f9be690-4133-4d34-a25a-d293308ed297 
BUG!
nictheboy@laptop:/tmp$ cat app/uploads/files/b7d8e04a-3a15-4688-ba24-13bfb3ebd037 
BUG!
nictheboy@laptop:/tmp$