mirror of
https://github.com/hedgedoc/hedgedoc.git
synced 2026-08-07 07:14:49 +00:00
Erik Michelson
c2ccf48c39
Previously, media uploads were associated with one note upload but served regardless of the requesting user's permission. As we have a fine-grade permission system in place, we can use this as well for enforcing permission checks on media uploads. In order to make an upload reusable across multiple notes, this adds the capability to link one media upload to multiple notes and unlink that accordingly again. Signed-off-by: Erik Michelson <github@erik.michelson.eu>
41 lines
1.3 KiB
TypeScript
41 lines
1.3 KiB
TypeScript
/*
|
|
* SPDX-FileCopyrightText: 2024 The HedgeDoc developers (see AUTHORS file)
|
|
*
|
|
* SPDX-License-Identifier: AGPL-3.0-only
|
|
*/
|
|
import { Controller, Get, Param, Res } from '@nestjs/common';
|
|
import { ApiTags } from '@nestjs/swagger';
|
|
import { FastifyReply } from 'fastify';
|
|
|
|
import { OpenApi } from '../api/utils/decorators/openapi.decorator';
|
|
import { ConsoleLoggerService } from '../logger/console-logger.service';
|
|
import { MediaService } from '../media/media.service';
|
|
import { RequestUserId } from '../api/utils/decorators/request-user-id.decorator';
|
|
import { PermissionError } from '../errors/errors';
|
|
|
|
@OpenApi()
|
|
@ApiTags('media-redirect')
|
|
@Controller()
|
|
export class MediaRedirectController {
|
|
constructor(
|
|
private readonly logger: ConsoleLoggerService,
|
|
private mediaService: MediaService,
|
|
) {
|
|
this.logger.setContext(MediaRedirectController.name);
|
|
}
|
|
|
|
@Get(':uuid')
|
|
@OpenApi(302, 404, 500)
|
|
async getMedia(
|
|
@RequestUserId() userId: number,
|
|
@Param('uuid') uuid: string,
|
|
@Res() response: FastifyReply,
|
|
): Promise<void> {
|
|
if (!(await this.mediaService.canUserAccessUpload(userId, uuid))) {
|
|
throw new PermissionError('You do not have permission to access this media upload.');
|
|
}
|
|
const url = await this.mediaService.getFileUrl(uuid);
|
|
await response.redirect(url);
|
|
}
|
|
}
|