valknar/sexy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: block unauthenticated access to premium video files on assets endpoint

Browse Source 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Sebastian Krüger
2026-03-12 10:07:35 +01:00
parent 68c74fc8df
commit 8a10c1e438
1 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
packages/backend/src/index.ts
View File

@@ -5,7 +5,7 @@ import fastifyMultipart from "@fastify/multipart";
import fastifyStatic from "@fastify/static"; import fastifyStatic from "@fastify/static";
import { createYoga } from "graphql-yoga"; import { createYoga } from "graphql-yoga";
import { eq } from "drizzle-orm"; import { eq } from "drizzle-orm";
import { files } from "./db/schema/index"; import { files, videos } from "./db/schema/index";
import path from "path"; import path from "path";
import { existsSync, mkdirSync } from "fs"; import { existsSync, mkdirSync } from "fs";
import { writeFile, rm } from "fs/promises"; import { writeFile, rm } from "fs/promises";
@@ -109,6 +109,20 @@ async function main() {
if (!result[0]) return reply.status(404).send({ error: "File not found" }); if (!result[0]) return reply.status(404).send({ error: "File not found" });
// Block unauthenticated access to premium video files
if (result[0].mime_type?.startsWith("video/")) {
const premiumCheck = await db
.select({ premium: videos.premium })
.from(videos)
.where(eq(videos.movie, id))
.limit(1);
if (premiumCheck[0]?.premium) {
const token = request.cookies["session_token"];
const sessionData = token ? await redis.get(`session:${token}`) : null;
if (!sessionData) return reply.status(401).send({ error: "Unauthorized" });
}
}
const { filename, mime_type } = result[0]; const { filename, mime_type } = result[0];
reply.header("Cache-Control", "public, max-age=31536000, immutable"); reply.header("Cache-Control", "public, max-age=31536000, immutable");