highperfocused/void.cat
1
0
Fork 0
mirror of https://git.v0l.io/Kieran/void.cat.git synced 2025-03-26 23:51:44 +01:00
Code Issues Packages Projects Releases Wiki Activity

prevent hot-linking viruses

Browse Source
This commit is contained in:
Kieran 2022-09-09 10:42:33 +01:00
parent 995e80cb77
commit 408697accb
No known key found for this signature in database
GPG Key ID: DE71CEB3925BE941
1 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
VoidCat/Controllers/DownloadController.cs
View File

@ -10,18 +10,20 @@ namespace VoidCat.Controllers;
[Route("d")]
public class DownloadController : Controller
{
private readonly VoidSettings _settings;
private readonly FileStoreFactory _storage;
private readonly FileInfoManager _fileInfo;
private readonly IPaymentOrderStore _paymentOrders;
private readonly ILogger<DownloadController> _logger;
public DownloadController(FileStoreFactory storage, ILogger<DownloadController> logger, FileInfoManager fileInfo,
IPaymentOrderStore paymentOrderStore)
IPaymentOrderStore paymentOrderStore, VoidSettings settings)
{
_storage = storage;
_logger = logger;
_fileInfo = fileInfo;
_paymentOrders = paymentOrderStore;
_settings = settings;
}
[HttpOptions]
@ -110,6 +112,17 @@ public class DownloadController : Controller
}
}
// prevent hot-linking viruses
var origin = Request.Headers.Origin.Count > 0 ? new Uri(Request.Headers.Origin.First()) : null;
var originWrong = !origin?.Host.Equals(_settings.SiteUrl.Host, StringComparison.InvariantCultureIgnoreCase) ??
false;
if (meta.VirusScan?.IsVirus == true && originWrong)
{
Response.StatusCode = (int) HttpStatusCode.Redirect;
Response.Headers.Location = $"/{id.ToBase58()}";
return default;
}
Response.Headers.XFrameOptions = "SAMEORIGIN";
Response.Headers.ContentDisposition = $"inline; filename=\"{meta?.Metadata?.Name}\"";
Response.ContentType = meta?.Metadata?.MimeType ?? "application/octet-stream";