From 67090e55213d22005909c5b937730546feaf2506 Mon Sep 17 00:00:00 2001
From: Matthias Ahouansou <matthias@ahouansou.cz>
Date: Mon, 7 Jul 2025 11:56:02 +0100
Subject: [PATCH 1/2] fix(media): only fetch remote media when requested by
 authenticated endpoints

this was already done for thumbnails, but I forgot to do so for full-sized media

(cherry picked from commit 7ddd32aeff9236f745ccbc27d9ff4ca26d4d8859)
---
 src/api/client_server/media.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/api/client_server/media.rs b/src/api/client_server/media.rs
index 4b55a511..e922b157 100644
--- a/src/api/client_server/media.rs
+++ b/src/api/client_server/media.rs
@@ -215,7 +215,7 @@ pub async fn get_content(
             content_type,
             content_disposition: Some(content_disposition),
         })
-    } else if server_name != services().globals.server_name() && allow_remote {
+    } else if server_name != services().globals.server_name() && allow_remote && authenticated {
         let remote_content_response = get_remote_content(server_name, media_id.clone()).await?;
 
         Ok(get_content::v1::Response {
@@ -297,7 +297,7 @@ async fn get_content_as_filename(
                     .with_filename(Some(filename.clone())),
             ),
         })
-    } else if server_name != services().globals.server_name() && allow_remote {
+    } else if server_name != services().globals.server_name() && allow_remote && authenticated {
         let remote_content_response = get_remote_content(server_name, media_id.clone()).await?;
 
         Ok(get_content_as_filename::v1::Response {

From db35c8b059386741320044ecbac633cf674010b4 Mon Sep 17 00:00:00 2001
From: Matthias Ahouansou <matthias@ahouansou.cz>
Date: Mon, 7 Jul 2025 11:57:13 +0100
Subject: [PATCH 2/2] chore(release): 0.10.6

---
 Cargo.lock | 2 +-
 Cargo.toml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 5bf810df..fbac4034 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -492,7 +492,7 @@ checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"
 
 [[package]]
 name = "conduit"
-version = "0.10.5"
+version = "0.10.6"
 dependencies = [
  "async-trait",
  "axum",
diff --git a/Cargo.toml b/Cargo.toml
index 913be3df..85e4e42d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -16,7 +16,7 @@ license = "Apache-2.0"
 name = "conduit"
 readme = "README.md"
 repository = "https://gitlab.com/famedly/conduit"
-version = "0.10.5"
+version = "0.10.6"
 
 # See also `rust-toolchain.toml`
 rust-version = "1.85.0"