Jelajahi Sumber

Fix /pic/ exploit

Zed 7 bulan lalu
induk
melakukan
33dd9b6668
1 mengubah file dengan 4 tambahan dan 0 penghapusan
  1. 4 0
      src/routes/media.nim

+ 4 - 0
src/routes/media.nim

@@ -93,6 +93,8 @@ proc createMediaRouter*(cfg: Config) =
 
 
     get re"^\/pic\/orig\/(enc)?\/?(.+)":
     get re"^\/pic\/orig\/(enc)?\/?(.+)":
       var url = decoded(request, 1)
       var url = decoded(request, 1)
+      cond "amplify_video" notin url
+
       if "twimg.com" notin url:
       if "twimg.com" notin url:
         url.insert(twimg)
         url.insert(twimg)
       if not url.startsWith(https):
       if not url.startsWith(https):
@@ -107,6 +109,8 @@ proc createMediaRouter*(cfg: Config) =
 
 
     get re"^\/pic\/(enc)?\/?(.+)":
     get re"^\/pic\/(enc)?\/?(.+)":
       var url = decoded(request, 1)
       var url = decoded(request, 1)
+      cond "amplify_video" notin url
+
       if "twimg.com" notin url:
       if "twimg.com" notin url:
         url.insert(twimg)
         url.insert(twimg)
       if not url.startsWith(https):
       if not url.startsWith(https):