nntrivi2001
26952ae0d9
- POST /api/me/avatar/url stores the https link (users.avatar_link) instead of downloading it; GET /api/me/avatar and /api/users/:id/avatar answer 302 to it (no referrer). Link rules: https, no userinfo, <= 2048 chars, no localhost or private/reserved IP literal. Upload and link replace each other. - Settings -> Account first loads the link as an embedded image and refuses one this browser cannot show: a picture behind a login (Mattermost's /api/v4/users/<id>/image) gets no cookie cross-site and 401s. - Files sidebar: each workspace under its owner's home, chevrons remembered per browser (agenthub.files.homesOpen); ownerless ones stay flat.
22 lines
856 B
JavaScript
22 lines
856 B
JavaScript
/**
|
|
* @file avatar-redirect.js
|
|
* @description Answers an avatar GET (`/api/me/avatar`, `/api/users/:id/avatar`)
|
|
* with a 302 to the account's stored avatar LINK (server/lib/avatars.js), so
|
|
* the viewer's browser loads the picture itself — with its own logins and
|
|
* network — and the server never fetches it. No referrer is sent with it.
|
|
* @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
|
|
*/
|
|
|
|
/** True when the account has a link and the redirect was sent. */
|
|
function sendAvatarLink(res, userId) {
|
|
const link = require("./avatars").avatarLink(userId);
|
|
if (!link) return false;
|
|
res.set("Referrer-Policy", "no-referrer");
|
|
// The client versions the URL with `avatarAt`, so a new link is a new URL.
|
|
res.set("Cache-Control", "private, max-age=86400");
|
|
res.redirect(302, link);
|
|
return true;
|
|
}
|
|
|
|
module.exports = { sendAvatarLink };
|