From 01b3e2c23017daae45f074e3931503e81dde37fb Mon Sep 17 00:00:00 2001 From: Meleki Date: Fri, 6 Mar 2026 15:35:01 +0100 Subject: [PATCH] =?UTF-8?q?Auth:=20Krea-Bilddateien=20ohne=20Authentifizie?= =?UTF-8?q?rung=20zug=C3=A4nglich=20machen?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - /api/images/file/{filename} und /api/images/file/{filename}/thumb als GET ohne Auth erlaubt (analog zu /api/shared/) --- Middleware/AuthMiddleware.cs | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Middleware/AuthMiddleware.cs b/Middleware/AuthMiddleware.cs index 4927377..6579d7d 100644 --- a/Middleware/AuthMiddleware.cs +++ b/Middleware/AuthMiddleware.cs @@ -24,7 +24,8 @@ public class AuthMiddleware var isTelegramWebhook = path.StartsWith("/api/telegram/webhook/") && ctx.Request.Method == "POST"; var isSharedGet = path.StartsWith("/api/shared/") && ctx.Request.Method == "GET"; var isAutologin = path == "/api/auth/autologin" && ctx.Request.Method == "GET"; - if (!path.StartsWith("/api/") || path == "/api/auth/login" || isTelegramWebhook || isSharedGet || isAutologin) + var isImageFile = path.StartsWith("/api/images/file/") && ctx.Request.Method == "GET"; + if (!path.StartsWith("/api/") || path == "/api/auth/login" || isTelegramWebhook || isSharedGet || isAutologin || isImageFile) { await _next(ctx); return;