- var request and var response in Init() → const (never reassigned,
var is function-scoped and hoisted which is undesirable in class methods)
- let formData in UploadChunk() → const (never reassigned)
- chunkResponse in UploadChunk() removed (assigned but never read)
- let start in GetChunks() → const (never reassigned)
- var percent in UpdateProgressBar() → const (never reassigned)
Archive is the local form model used for version/changelog input.
On a new upload Archive.Id is Guid.Empty, so callers received an
empty GUID instead of the real database ID. Pass uploadedArchive.Id,
which is the record fetched from the database after the upload
completes.
If ChunkUploader.Start() threw a JS interop exception Uploading was
left as true permanently, disabling the Upload and Cancel buttons
for the rest of the session without any visible error. Using a
finally block ensures the flag is reset whether the call succeeds,
throws, or is cancelled.
FileMode.Append forces all writes to the end of the file, making
fs.Position assignments ineffective. This works by accident on a
fresh sequential upload but will silently corrupt the file on any
retry, since chunks are re-sent from their original offset but land
at the current end instead. Use FileMode.OpenOrCreate so the seek
to chunk.Start is honoured.
/api/Upload/Init and /api/Upload/Chunk had no authorization policy,
meaning any unauthenticated request could create archive database
records and write arbitrary data to server storage. Every other
endpoint group in the application requires authorization; apply
the same administrator role requirement here.
