+function put(req, res, next) {
+ var oldFilePath = decodeURIComponent(req.params[0]);
+
+ if (!req.body || !req.body.newFilePath) return next(new HttpError(400, 'missing newFilePath'));
+
+ var newFilePath = decodeURIComponent(req.body.newFilePath);
+
+ debug('put: %s -> %s', oldFilePath, newFilePath);
+
+ var absoluteOldFilePath = getAbsolutePath(oldFilePath);
+ if (!absoluteOldFilePath || isProtected(absoluteOldFilePath)) return next(new HttpError(403, 'Path not allowed'));
+
+ var absoluteNewFilePath = getAbsolutePath(newFilePath);
+ if (!absoluteNewFilePath || isProtected(absoluteNewFilePath)) return next(new HttpError(403, 'Path not allowed'));
+
+ fs.rename(absoluteOldFilePath, absoluteNewFilePath, function (error) {
+ if (error) return next (new HttpError(500, error));
+
+ debug('put: successful');
+
+ return next(new HttpSuccess(200, {}));
+ });
+}
+