Fix a bug where you can accidentally overwrite tarballs in some cases.

1 files changed, 27 insertions, 12 deletions

diff --git a/lib/utils/registry/publish.js b/lib/utils/registry/publish.js
index 5ccf2fb26..08479991d 100644
--- a/lib/utils/registry/publish.js
+++ b/lib/utils/registry/publish.js
@@ -5,6 +5,7 @@ module.exports = publish
 var request = require("./request")
   , GET = request.GET
   , PUT = request.PUT
+  , DELETE = request.DELETE
   , reg = request.reg
   , upload = request.upload
   , log = require("../log")
@@ -56,20 +57,34 @@ function publish (data, cb) {
     ) {
       return log.er(cb, "Failed PUT response "+(response && response.statusCode))(er)
     }
-    GET(encodeURIComponent(data.name), function (er, d) {
-      if (er) return cb(er)
-
-      var rev = d && ("-rev/"+d._rev)
-        , tarball = path.join(npm.cache, data.name, data.version, "package.tgz")
-        , dataURI = encodeURIComponent(data.name)+"/"+encodeURIComponent(data.version)
-      log(tarball, "tarball")
-      attURI += "/" + rev
-      upload(attURI, tarball, function (er) {
-        log("back from upload", "publish")
-        if (er) return log.er(cb, "Couldn't send tarball")(er)
-        PUT(dataURI, data, log.er(cb, "Error sending version data"))
+    var dataURI = encodeURIComponent(data.name)+"/"+encodeURIComponent(data.version)
+    PUT(dataURI, data, function (er) {
+      if (er) return log.er(cb, "Error sending version data")(er)
+      GET(encodeURIComponent(data.name), function (er, d) {
+        if (er) return cb(er)
+        var rev = d && ("-rev/"+d._rev)
+          , tarball = path.join(npm.cache, data.name, data.version, "package.tgz")
+        log(tarball, "tarball")
+        attURI += "/" + rev
+        upload(attURI, tarball, function (er) {
+          log("back from upload", "publish")
+          if (er) {
+            log("Couldn't send tarball", "publish fail")
+            return fail(cb, er)
+          }
+          cb()
+        })
       })
     })
   })
 }
 
+function fail (cb, er) {
+  log(er, "publish fail")
+  npm.commands.unpublish([data.name, data.version], function (er2, ok) {
+    if (er2) return log.er(cb,
+      "Invalid data in registry! Please report this error\n")(er2)
+    log("Successfully unpublished", "publish fail")
+    cb(er)
+  })
+}