1 files changed, 40 insertions, 5 deletions

diff --git a/app/core/files.js b/app/core/files.js
index 90584ef..61df225 100644
--- a/app/core/files.js
+++ b/app/core/files.js
@@ -3,6 +3,7 @@
 var fs = require('fs'),
     _ = require('lodash'),
     mongoose = require('mongoose'),
+    helpers = require('./helpers'),
     settings = require('./../config').files,
     enabled = settings.enable,
     provider = _.find([
@@ -42,7 +43,7 @@ FileManager.prototype.create = function(options, cb) {
         if (room.archived) {
             return cb('Room is archived.');
         }
-        
+
         new File({
             owner: options.owner,
             name: options.file.originalname,
@@ -75,8 +76,18 @@ FileManager.prototype.create = function(options, cb) {
 };
 
 FileManager.prototype.list = function(options, cb) {
+    options = options || {};
+
+    options = helpers.sanitizeQuery(options, {
+        defaults: {
+            reverse: true,
+            take: 500
+        },
+        maxTake: 5000
+    });
+
     var File = mongoose.model('File'),
-    User = mongoose.model('User');
+        User = mongoose.model('User');
 
     var find = File.find();
 
@@ -84,10 +95,34 @@ FileManager.prototype.list = function(options, cb) {
         find.where('room', options.room);
     }
 
+    if (options.from) {
+        find.where('uploaded').gt(options.from);
+    }
+
+    if (options.to) {
+        find.where('uploaded').lte(options.to);
+    }
+
+    if (options.expand && _.isArray(options.include)) {
+        var includes = options.expand.split(',');
+
+        if (_.includes(includes, 'owner')) {
+            find.populate('owner', 'id username displayName email avatar');
+        }
+    }
+
+    if (options.skip) {
+        find.skip(options.skip);
+    }
+
+    if (options.reverse) {
+        find.sort({ 'uploaded': -1 });
+    } else {
+        find.sort({ 'uploaded': 1 });
+    }
+
     find
-    .populate('owner', 'id username displayName email avatar')
-    .limit(options.limit || 500)
-    .sort({ 'uploaded': -1 })
+    .limit(options.limit)
     .exec(function(err, files) {
         if (err) {
             console.error(err);