github/TREK
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

revert: remove auth from file uploads — breaks img/pdf rendering in browser

Browse Source
This commit is contained in:
Maurice
2026-03-30 20:56:56 +02:00
parent 4ddfa92c14
commit 26c1676cdd
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
server/src/index.ts
View File

@@ -113,10 +113,10 @@ import { authenticate } from './middleware/auth';
app.use('/uploads/avatars', express.static(path.join(__dirname, '../uploads/avatars'))); app.use('/uploads/avatars', express.static(path.join(__dirname, '../uploads/avatars')));
app.use('/uploads/covers', express.static(path.join(__dirname, '../uploads/covers'))); app.use('/uploads/covers', express.static(path.join(__dirname, '../uploads/covers')));
// Files and photos require authentication (covers and avatars are public — served statically above) // Serve uploaded files (UUIDs are unguessable, path traversal protected)
app.get('/uploads/:type/:filename', authenticate, (req: Request, res: Response) => { app.get('/uploads/:type/:filename', (req: Request, res: Response) => {
const { type, filename } = req.params; const { type, filename } = req.params;
const allowedTypes = ['files', 'photos']; const allowedTypes = ['covers', 'files', 'photos'];
if (!allowedTypes.includes(type)) return res.status(404).send('Not found'); if (!allowedTypes.includes(type)) return res.status(404).send('Not found');
// Prevent path traversal // Prevent path traversal