file uploaded path correction

server/index.js

@@ -14,7 +14,7 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const PORT = process.env.PORT || 3001;
 const UPLOAD_DIR = process.env.UPLOAD_DIR || path.join(__dirname, 'uploads');
 // Public URL prefix on Apache (e.g. /citpl_website). Leave empty if site is at domain root.
-const SITE_BASE = (process.env.SITE_BASE || '/citpl_website').replace(/\/$/, '');
+const SITE_BASE = (process.env.SITE_BASE ?? '').replace(/\/$/, '');
 const distDir = path.join(__dirname, '..', 'dist');
 const publicAssetsDir = path.join(__dirname, '..', 'public', 'assets');
 const serveStatic =
@@ -31,7 +31,11 @@ app.use(cors({
   credentials: true,
 }));
 
-app.use(express.json({ limit: '10mb' }));
+// Only parse JSON for non-multipart requests — multer handles multipart/form-data
+app.use((req, res, next) => {
+  if (req.headers['content-type']?.startsWith('multipart/form-data')) return next();
+  express.json({ limit: '10mb' })(req, res, next);
+});
 
 function mountApp(base) {
   const prefix = base || '';
@@ -48,8 +52,8 @@ function mountApp(base) {
 
   if (serveStatic) {
     app.use(prefix || '/', express.static(distDir));
-    // SPA fallback only for the app's base path, not root-level unknown files
-    app.get(`${prefix}/*`, (req, res, next) => {
+    // SPA fallback — Express 5 requires named wildcard /*path (not /*)
+    app.get(`${prefix}/*path`, (req, res, next) => {
       const ext = req.path.split('.').pop();
       if (ext && ext !== req.path) return next();
       res.sendFile(path.join(distDir, 'index.html'));