Erik Michelson 6c5b44eaec feat(media): serve uploads from local filesystem with permission check ...

Previously, the permission checks of the /media/:uuid route could be
bypassed for the local filesystem as a media backend, because the
/media/:uuid route performed a redirect to the target after checking
the permissions. Since the target was always /uploads/:uuid.ext where
ext was the extension of the uploaded file, you could simply try to
guess the file extension and have access to the file since the
/uploads endpoint was simply the complete uploads folder mounted.
Now, media uploads from the local filesystem backend are served
under the /media route directly instead of a redirect.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>

2026-07-24 22:17:00 +02:00

..

.gitignore

fix(docs): adjust frontend and reverse proxy docs

2022-11-20 21:49:56 +01:00

Caddyfile

feat(media): serve uploads from local filesystem with permission check

2026-07-24 22:17:00 +02:00

package.json

fix: caddy candidate order

2024-09-01 08:43:23 +02:00

package.json.license

misc: add turbo monorepo util

2023-02-07 21:38:40 +01:00