Browse Source

Deny downloading from wrong host

master
Menci 6 years ago
parent
commit
6218e49278
  1. 5
      modules/api_v2.js

5
modules/api_v2.js

@ -1,4 +1,5 @@
const jwt = require('jsonwebtoken');
const url = require('url');
app.get('/api/v2/search/users/:keyword*?', async (req, res) => {
try {
@ -120,6 +121,10 @@ app.apiRouter.get('/api/v2/download/:token', async (req, res) => {
try {
const token = req.params.token, data = jwt.decode(token);
if (!data) throw new ErrorMessage("无效的令牌。");
if (url.parse(syzoj.utils.getCurrentLocation(req, true)).href !== url.parse(syzoj.config.site_for_download).href) {
throw new ErrorMessage("无效的下载地址。");
}
if (verifyJWT(token)) {
res.download(data.filename, data.sendName);
} else {

Loading…
Cancel
Save