fix: rewrite avatarproxy and CachedImage #1016
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| try { | ||
| const jellyfinAvatar = req.url.match( |
There was a problem hiding this comment.
This regex should be set on router part and not inside the route no ?
And if you want to keep it here the regex look like wrong as it's missing ^, would be catched : https://test.fake/Users/efefe/Images/Primary/?tag=efefe&quality=90 (even if it's useless)
There was a problem hiding this comment.
This regex should be set on router part and not inside the route no ?
It could be set in the router path yes. But I did it this way to be consistent with what is made on front-end. Both ways seems fine to me.
And having it in the router path would require to reconstruct the URL with the URL param and the URL query
| // tmdb stuff | ||
| imageUrl = | ||
| currentSettings.cacheImages && !src.startsWith('/') | ||
| ? src.replace('https://image.tmdb.org', '/imageproxy') |
There was a problem hiding this comment.
src.replace doesn't check if this string is present at the beginning so https://fake.test/https://image.tmdb.org?pic=mypic would be converted to https://fake.test/imageproxy?pic=mypic
|
Tested. Seems to be working as intended |
|
🎉 This PR is included in version 2.0.1 🎉 The release is available on:
Your semantic-release bot 📦🚀 |
Description
Avatar proxy was allowing every request to be proxied, no matter the original ressource's origin or filetype. This PR fixes it be allowing only relevant resources to be cached, i.e. Jellyfin/Emby images and TMDB images.
Screenshot (if UI-related)
To-Dos
pnpm buildpnpm i18n:extractIssues Fixed or Closed