Some response delays to make brute force harder; Code Reformat

lib/endpoints.js

@@ -41,13 +41,12 @@ app.get('/robots.txt', (req, res) => {
 });
 
 // Upload App
-//
-//
 app.get('/', (req, res) => {
-		 if (config.uploadAppPath != '/') 
+  if (config.uploadAppPath !== '/') {
     res.status(304).redirect(config.uploadAppPath);
-		else
+  } else {
     res.sendFile(path.join(__dirname, '../public/html/upload.html'));
+  }
 });
 
 app.get(config.uploadAppPath, (req, res) => {
@@ -70,8 +69,18 @@ app.get('/admin', (req, res, next) => {
 });
 app.get('/admin/data.json', (req, res, next) => {
   if (!config.adminPass) return next();
-  if(!req.get('x-passwd')) return res.status(401).send('Unauthorized');
+
-  if(req.get('x-passwd') !== config.adminPass) return res.status(403).send('Forbidden');
+  const bfTimeout = 500;
+
+  if (!req.get('x-passwd')) {
+    // delay answer to make brute force attacks more difficult
+    setTimeout(() => res.status(401).send('Unauthorized'), bfTimeout);
+    return;
+  }
+  if (req.get('x-passwd') !== config.adminPass) {
+    setTimeout(() => res.status(403).send('Forbidden'), bfTimeout);
+    return;
+  }
 
   const result = _.chain(db.db)
     .cloneDeep()
@@ -88,10 +97,7 @@ app.get('/admin/data.json', (req, res, next) => {
     })
     .value();
 
-  // make bruteforce attack more difficult
+  setTimeout(() => res.json(result), bfTimeout);
-  setTimeout(() => {
-    res.json(result);
-  },250);
 });
 
 
@@ -129,7 +135,6 @@ app.get('/files/:fid', async(req, res, next) => {
 
   // Download all files
   if (req.params.fid.match(/^[a-z0-9+]+\.(tar\.gz|zip)$/)) {
-    const sid = req.params.fid.split('++')[0];
     const format = req.params.fid.endsWith('.zip') ? 'zip' : 'tar.gz';
     const bucket = db.get(sid);
 
@@ -174,7 +179,8 @@ app.get('/files/:fid', async(req, res, next) => {
           }
         });
       });
-    } catch(e) {
+    }
+    catch (e) {
       console.error(e);
     }
 
@@ -195,7 +201,8 @@ app.get('/files/:fid', async(req, res, next) => {
         await db.updateLastDownload(info.metadata.sid, info.metadata.key);
       }
     });
-  } catch(e) {
+  }
+  catch (e) {
     res.status(404).send(errorPage.replace('%%ERROR%%', e.message));
   }
 });