Merge commit from fork

9ec9a5c51cb6e3273777f0bd1bf268bff2b7e6f1

Cohee <18619528+Cohee1207@users.noreply.github.com>

Signed

src/server-main.js+13 -10 Viewed

     app.use(accessLoggerMiddleware());
+}
-if (cliArgs.enableCorsProxy) {
-    app.use('/proxy/:url(*)', corsProxyMiddleware);
-} else {
-    app.use('/proxy/:url(*)', async (_, res) => {
-        const message = 'CORS proxy is disabled. Enable it in config.yaml or use the --corsProxy flag.';
-        console.log(message);
-        res.status(404).send(message);
-    });
-}
 app.use(cookieSession({
     name: getCookieSessionName(),
     sameSite: 'lax',

+            }
             req.session.csrfToken = token;
         },
+        skipCsrfProtection: (req) => {
+            return cliArgs.enableCorsProxy ? /^\/proxy\//.test(req.path) : false;
+        },
         size: 32,
     });

     response.sendStatus(204);
 });
+if (cliArgs.enableCorsProxy) {
+    app.use('/proxy/:url(*)', corsProxyMiddleware);
+} else {
+    app.use('/proxy/:url(*)', async (_, res) => {
+        const message = 'CORS proxy is disabled. Enable it in config.yaml or use the --corsProxy flag.';
+        console.log(message);
+        res.status(404).send(message);
+    });
+}
 // File uploads
 const uploadsPath = path.join(cliArgs.dataRoot, UPLOADS_DIRECTORY);
 app.use(multer({ dest: uploadsPath, limits: { fieldSize: 500 * 1024 * 1024 } }).single('avatar'));