From 67090e55213d22005909c5b937730546feaf2506 Mon Sep 17 00:00:00 2001 From: Matthias Ahouansou Date: Mon, 7 Jul 2025 11:56:02 +0100 Subject: [PATCH] fix(media): only fetch remote media when requested by authenticated endpoints this was already done for thumbnails, but I forgot to do so for full-sized media (cherry picked from commit 7ddd32aeff9236f745ccbc27d9ff4ca26d4d8859) --- src/api/client_server/media.rs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/api/client_server/media.rs b/src/api/client_server/media.rs index 4b55a511..e922b157 100644 --- a/src/api/client_server/media.rs +++ b/src/api/client_server/media.rs @@ -215,7 +215,7 @@ pub async fn get_content( content_type, content_disposition: Some(content_disposition), }) - } else if server_name != services().globals.server_name() && allow_remote { + } else if server_name != services().globals.server_name() && allow_remote && authenticated { let remote_content_response = get_remote_content(server_name, media_id.clone()).await?; Ok(get_content::v1::Response { @@ -297,7 +297,7 @@ async fn get_content_as_filename( .with_filename(Some(filename.clone())), ), }) - } else if server_name != services().globals.server_name() && allow_remote { + } else if server_name != services().globals.server_name() && allow_remote && authenticated { let remote_content_response = get_remote_content(server_name, media_id.clone()).await?; Ok(get_content_as_filename::v1::Response {