Merge commit from fork

9ec9a5c51cb6e3273777f0bd1bf268bff2b7e6f1

Cohee <18619528+Cohee1207@users.noreply.github.com>

Signed
1 files changed, +13 -10Showing whitespace changes
src/server-main.js+13 -10
@@ -145,16 +145,6 @@ if (cliArgs.listen) {
145145 app.use(accessLoggerMiddleware());
146146}
147147
148-if (cliArgs.enableCorsProxy) {
149- app.use('/proxy/:url(*)', corsProxyMiddleware);
150-} else {
151- app.use('/proxy/:url(*)', async (_, res) => {
152- const message = 'CORS proxy is disabled. Enable it in config.yaml or use the --corsProxy flag.';
153- console.log(message);
154- res.status(404).send(message);
155- });
156-}
157-
158148app.use(cookieSession({
159149 name: getCookieSessionName(),
160150 sameSite: 'lax',
@@ -185,6 +175,9 @@ if (!cliArgs.disableCsrf) {
185175 }
186176 req.session.csrfToken = token;
187177 },
178+ skipCsrfProtection: (req) => {
179+ return cliArgs.enableCorsProxy ? /^\/proxy\//.test(req.path) : false;
180+ },
188181 size: 32,
189182 });
190183
@@ -252,6 +245,16 @@ app.post('/api/ping', (request, response) => {
252245 response.sendStatus(204);
253246});
254247
248+if (cliArgs.enableCorsProxy) {
249+ app.use('/proxy/:url(*)', corsProxyMiddleware);
250+} else {
251+ app.use('/proxy/:url(*)', async (_, res) => {
252+ const message = 'CORS proxy is disabled. Enable it in config.yaml or use the --corsProxy flag.';
253+ console.log(message);
254+ res.status(404).send(message);
255+ });
256+}
257+
255258// File uploads
256259const uploadsPath = path.join(cliArgs.dataRoot, UPLOADS_DIRECTORY);
257260app.use(multer({ dest: uploadsPath, limits: { fieldSize: 500 * 1024 * 1024 } }).single('avatar'));