瀏覽代碼

Fix /pic/ exploit

Zed 7 月之前
父節點
當前提交
33dd9b6668
共有 1 個文件被更改,包括 4 次插入0 次删除
  1. 4 0
      src/routes/media.nim

+ 4 - 0
src/routes/media.nim

@@ -93,6 +93,8 @@ proc createMediaRouter*(cfg: Config) =
 
     get re"^\/pic\/orig\/(enc)?\/?(.+)":
       var url = decoded(request, 1)
+      cond "amplify_video" notin url
+
       if "twimg.com" notin url:
         url.insert(twimg)
       if not url.startsWith(https):
@@ -107,6 +109,8 @@ proc createMediaRouter*(cfg: Config) =
 
     get re"^\/pic\/(enc)?\/?(.+)":
       var url = decoded(request, 1)
+      cond "amplify_video" notin url
+
       if "twimg.com" notin url:
         url.insert(twimg)
       if not url.startsWith(https):