repos / pico

commit

c595251

parent

c388a05

author

Eric Bower

date

2024-10-08 21:40:21 +0000 UTC

fix(pico): reject external service redirects for non-paid users

 1@@ -36,6 +36,7 @@ type AssetHandler struct {
 2 	Bucket         sst.Bucket
 3 	ImgProcessOpts *storage.ImgProcessOpts
 4 	ProjectID      string
 5+	HasPicoPlus    bool
 6 }
 7 
 8 func checkHandler(w http.ResponseWriter, r *http.Request) {
 9@@ -212,6 +213,17 @@ func (h *AssetHandler) handle(logger *slog.Logger, w http.ResponseWriter, r *htt
10 			http.Redirect(w, r, fp.Filepath, fp.Status)
11 			return
12 		} else if hasProtocol(fp.Filepath) {
13+			if !h.HasPicoPlus {
14+				msg := "must be pico+ user to fetch content from external source"
15+				logger.Error(
16+					msg,
17+					"destination", fp.Filepath,
18+					"status", fp.Status,
19+				)
20+				http.Error(w, msg, http.StatusUnauthorized)
21+				return
22+			}
23+
24 			logger.Info(
25 				"fetching content from external service",
26 				"destination", fp.Filepath,
27@@ -452,6 +464,8 @@ func ServeAsset(fname string, opts *storage.ImgProcessOpts, fromImgs bool, hasPe
28 		return
29 	}
30 
31+	hasPicoPlus := dbpool.HasFeatureForUser(user.ID, "plus")
32+
33 	asset := &AssetHandler{
34 		Username:       props.Username,
35 		UserID:         user.ID,
36@@ -465,6 +479,7 @@ func ServeAsset(fname string, opts *storage.ImgProcessOpts, fromImgs bool, hasPe
37 		Bucket:         bucket,
38 		ImgProcessOpts: opts,
39 		ProjectID:      projectID,
40+		HasPicoPlus:    hasPicoPlus,
41 	}
42 
43 	asset.handle(logger, w, r)