Prevent subdirectories in user export

This commit also refactors the code a bit, and adds a '-' separator
between a filename and its duplicate index.

This commit fixes #1079.

Signed-off-by: Daan Sprenkels <hello@dsprenkels.com>

Author: Daan Sprenkels

lib/web/userRouter.js

@@ -90,18 +90,20 @@ UserRouter.get('/me/export', function (req, res) {
           ownerId: user.id
         }
       }).then(function (notes) {
-        let list = []
+        let filenames = {}
         async.each(notes, function (note, callback) {
-          let title
-          let extension = ''
+          let basename = note.title.replace(/\//g, '-') // Prevent subdirectories
+          let filename
+          let suffix = ''
           do {
-            title = note.title + extension
-            extension++
-          } while (list.indexOf(title) !== -1)
+            let seperator = typeof suffix === 'number' ? '-' : ''
+            filename = basename + seperator + suffix + '.md'
+            suffix++
+          } while (filenames[filename])
+          filenames[filename] = true
 
-          list.push(title)
-          logger.debug('Write: ' + title + '.md')
-          archive.append(Buffer.from(note.content), { name: title + '.md', date: note.lastchangeAt })
+          logger.debug('Write: ' + filename)
+          archive.append(Buffer.from(note.content), { name: filename, date: note.lastchangeAt })
           callback(null, null)
         }, function (err) {
           if (err) {