regalijan/car-crushers-portal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Set origin based on browser origin header

Browse Source
This commit is contained in:
regalijan 2023-10-19 16:50:17 -04:00
parent 45e05d78c7
commit e0f2a79d70
Signed by: regalijan
GPG Key ID: 5D4196DA269EF520
2 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
functions/api/reports/submit.ts
View File

@ -37,6 +37,9 @@ export async function onRequestPost(context: RequestContext) {
if (!success) return errorResponse("Captcha test failed", 403);
}
const origin = context.request.headers.get("Origin");
if (!origin) return errorResponse("No origin header", 400);
if (bypass && !(context.data.current_user?.permissions & (1 << 5)))
return errorResponse("Bypass directive cannot be used", 403);
@ -178,6 +181,7 @@ export async function onRequestPost(context: RequestContext) {
`t/${fileUploadKey}`,
file.size,
fileExten,
origin,
),
);
}

6
functions/gcloud.ts
View File

@ -17,6 +17,7 @@ export async function GenerateUploadURL(
path: string,
size: number,
fileExt: string,
origin: string,
): Promise<string> {
const accessToken = await GetAccessToken(env);
const contentTypes: { [k: string]: string } = {
@ -43,10 +44,7 @@ export async function GenerateUploadURL(
{
headers: {
authorization: `Bearer ${accessToken}`,
origin:
typeof env.LOCAL === "undefined"
? "https://carcrushers.cc"
: "http://localhost:8788",
origin,
"x-upload-content-type": contentTypes[fileExt],
"x-upload-content-length": size.toString(),
},