Make functions work with both connection and pool (#3420)

[lemmy.git] / crates / routes / src / images.rs

diff --git a/crates/routes/src/images.rs b/crates/routes/src/images.rs
index cb7187d55c0b019d6235a1b5bafadb176497027c..b79a38ffdc86d82ec673419dfec0fc1cf0dc9902 100644 (file)
--- a/crates/routes/src/images.rs
+++ b/crates/routes/src/images.rs
@@ -11,13 +11,18 @@ use actix_web::{
   HttpResponse,
 };
 use futures::stream::{Stream, StreamExt};
-use lemmy_utils::{claims::Claims, rate_limit::RateLimit, REQWEST_TIMEOUT};
-use lemmy_websocket::LemmyContext;
+use lemmy_api_common::{context::LemmyContext, utils::local_user_view_from_jwt};
+use lemmy_db_schema::source::local_site::LocalSite;
+use lemmy_utils::{claims::Claims, rate_limit::RateLimitCell, REQWEST_TIMEOUT};
 use reqwest::Body;
 use reqwest_middleware::{ClientWithMiddleware, RequestBuilder};
 use serde::{Deserialize, Serialize};
 
-pub fn config(cfg: &mut web::ServiceConfig, client: ClientWithMiddleware, rate_limit: &RateLimit) {
+pub fn config(
+  cfg: &mut web::ServiceConfig,
+  client: ClientWithMiddleware,
+  rate_limit: &RateLimitCell,
+) {
   cfg
     .app_data(web::Data::new(client))
     .service(
@@ -123,6 +128,21 @@ async fn full_res(
   client: web::Data<ClientWithMiddleware>,
   context: web::Data<LemmyContext>,
 ) -> Result<HttpResponse, Error> {
+  // block access to images if instance is private and unauthorized, public
+  let local_site = LocalSite::read(&mut context.pool())
+    .await
+    .map_err(error::ErrorBadRequest)?;
+  if local_site.private_instance {
+    let jwt = req
+      .cookie("jwt")
+      .expect("No auth header for picture access");
+    if local_user_view_from_jwt(jwt.value(), &context)
+      .await
+      .is_err()
+    {
+      return Ok(HttpResponse::Unauthorized().finish());
+    };
+  }
   let name = &filename.into_inner();
 
   // If there are no query params, the URL is original
@@ -138,7 +158,7 @@ async fn full_res(
     let mut url = format!("{}image/process.{}?src={}", pictrs_config.url, format, name,);
 
     if let Some(size) = params.thumbnail {
-      url = format!("{}&thumbnail={}", url, size,);
+      url = format!("{url}&thumbnail={size}",);
     }
     url
   };