| @@ -145,16 +145,6 @@ if (cliArgs.listen) { | ||
| 145 | 145 | app.use(accessLoggerMiddleware()); |
| 146 | 146 | } |
| 147 | 147 | |
| 148 | -if (cliArgs.enableCorsProxy) { | |
| 149 | - app.use('/proxy/:url(*)', corsProxyMiddleware); | |
| 150 | -} else { | |
| 151 | - app.use('/proxy/:url(*)', async (_, res) => { | |
| 152 | - const message = 'CORS proxy is disabled. Enable it in config.yaml or use the --corsProxy flag.'; | |
| 153 | - console.log(message); | |
| 154 | - res.status(404).send(message); | |
| 155 | - }); | |
| 156 | -} | |
| 157 | - | |
| 158 | 148 | app.use(cookieSession({ |
| 159 | 149 | name: getCookieSessionName(), |
| 160 | 150 | sameSite: 'lax', |
| @@ -185,6 +175,9 @@ if (!cliArgs.disableCsrf) { | ||
| 185 | 175 | } |
| 186 | 176 | req.session.csrfToken = token; |
| 187 | 177 | }, |
| 178 | + skipCsrfProtection: (req) => { | |
| 179 | + return cliArgs.enableCorsProxy ? /^\/proxy\//.test(req.path) : false; | |
| 180 | + }, | |
| 188 | 181 | size: 32, |
| 189 | 182 | }); |
| 190 | 183 | |
| @@ -252,6 +245,16 @@ app.post('/api/ping', (request, response) => { | ||
| 252 | 245 | response.sendStatus(204); |
| 253 | 246 | }); |
| 254 | 247 | |
| 248 | +if (cliArgs.enableCorsProxy) { | |
| 249 | + app.use('/proxy/:url(*)', corsProxyMiddleware); | |
| 250 | +} else { | |
| 251 | + app.use('/proxy/:url(*)', async (_, res) => { | |
| 252 | + const message = 'CORS proxy is disabled. Enable it in config.yaml or use the --corsProxy flag.'; | |
| 253 | + console.log(message); | |
| 254 | + res.status(404).send(message); | |
| 255 | + }); | |
| 256 | +} | |
| 257 | + | |
| 255 | 258 | // File uploads |
| 256 | 259 | const uploadsPath = path.join(cliArgs.dataRoot, UPLOADS_DIRECTORY); |
| 257 | 260 | app.use(multer({ dest: uploadsPath, limits: { fieldSize: 500 * 1024 * 1024 } }).single('avatar')); |