From 77eb80593601f6e492a595473ed867cc4d54e95e Mon Sep 17 00:00:00 2001
From: mike12345567 <me@michaeldrury.co.uk>
Date: Tue, 17 Dec 2024 13:13:07 +0000
Subject: [PATCH] Fixing an issue where plugins are imported as apps, which can
 crash the service - return a useful message to tell the user this is a plugin
 not an app export.

---
 packages/server/src/sdk/app/backups/imports.ts | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/packages/server/src/sdk/app/backups/imports.ts b/packages/server/src/sdk/app/backups/imports.ts
index 70ac3af1ff..85f5b030bd 100644
--- a/packages/server/src/sdk/app/backups/imports.ts
+++ b/packages/server/src/sdk/app/backups/imports.ts
@@ -191,6 +191,16 @@ export async function importApp(
     if (stillEncrypted) {
       throw new Error("Files are encrypted but no password has been supplied.")
     }
+    const isPlugin = !!contents.find(name => name === "plugin.min.js")
+    if (isPlugin) {
+      throw new Error("Supplied file is a plugin - cannot import as app.")
+    }
+    const isInvalid = !contents.find(name => name === DB_EXPORT_FILE)
+    if (isInvalid) {
+      throw new Error(
+        "App export does not appear to be valid - no DB file found."
+      )
+    }
     // have to handle object import
     if (contents.length && opts.importObjStoreContents) {
       let promises = []