From 4ddfa92c14c55d35a5127c24d53d3587181d0bc4 Mon Sep 17 00:00:00 2001 From: Maurice Date: Mon, 30 Mar 2026 20:51:38 +0200 Subject: [PATCH] security: require auth for file and photo uploads /uploads/files/ and /uploads/photos/ now require a valid Bearer token. Covers and avatars remain public (needed for shared pages and profiles). Prevents unauthenticated access to uploaded documents and trip photos. --- server/src/index.ts | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/server/src/index.ts b/server/src/index.ts index a485c13..5dc9f9d 100644 --- a/server/src/index.ts +++ b/server/src/index.ts @@ -109,13 +109,14 @@ if (DEBUG) { } // Avatars are public (shown on login, sharing screens) +import { authenticate } from './middleware/auth'; app.use('/uploads/avatars', express.static(path.join(__dirname, '../uploads/avatars'))); app.use('/uploads/covers', express.static(path.join(__dirname, '../uploads/covers'))); -// All other uploads require authentication -app.get('/uploads/:type/:filename', (req: Request, res: Response) => { +// Files and photos require authentication (covers and avatars are public — served statically above) +app.get('/uploads/:type/:filename', authenticate, (req: Request, res: Response) => { const { type, filename } = req.params; - const allowedTypes = ['covers', 'files', 'photos']; + const allowedTypes = ['files', 'photos']; if (!allowedTypes.includes(type)) return res.status(404).send('Not found'); // Prevent path traversal