Koko210/immich-folio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

release: v0.19.0

Browse Source 
Release v0.19.0. See the `## [0.19.0] — 2026-09-29` section of
[CHANGELOG.md](https://github.com/ralksta/immich-folio/blob/dev/CHANGELOG.md)
for the full list.

Highlights: client proofing links (#683), custom content pages (#738),
asset picker search (#740), concurrent-edit detection (#742), env-locked
settings (#739), an accessibility baseline (#741), three security fixes
with advisories (#737, #755, #759), and a pre-release quality pass
(#780–#797).

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>
This commit is contained in:
Ralksta
2026-09-29 22:50:30 +02:00
committed by GitHub
parent 5f251923f0
commit ad8b09700b
297 changed files with 19398 additions and 1800 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
app/api/image/[id]/route.ts
View File

@@ -3,13 +3,15 @@
* without exposing the Immich server or API key.
*
* Usage: GET /api/image/:token?size=thumbnail|preview|original
* GET /api/image/:token?w=640&q=75 (for next/image loader)
* GET /api/image/:token?size=preview&w=1440 (next/image loader, lib/imageSize.ts)
* The :token is an encoded asset ID (not a raw UUID).
*/
import { NextRequest, NextResponse } from 'next/server';
import { immich, ImmichUnavailableError } from '@/lib/immich';
import { resolveImageSize } from '@/lib/imageSize';
import { isPublishedAsset } from '@/lib/publishedAssets';
import { isAdminAuthenticated } from '@/lib/admin/auth';
import { decodeAssetId } from '@/lib/tokens';
import { getConfig } from '@/lib/config';
import { checkRateLimit, getClientIp, retryAfterSeconds } from '@/lib/rate-limit';
@@ -69,6 +71,16 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
return NextResponse.json({ error: 'Invalid token' }, { status: 400 });
}
// Only what the site currently shows (GHSA-gfh4-6275-9gqv): a token stays
// decodable forever, so an unpublished album or a revoked proofing link
// would otherwise keep serving. Signed-in admins pass for previews.
if (!(await isPublishedAsset(assetId)) && !(await isAdminAuthenticated())) {
return NextResponse.json(
{ error: 'Not found' },
{ status: 404, headers: { 'Cache-Control': 'no-store' } },
);
}
const size = resolveImageSize(
request.nextUrl.searchParams.get('size'),
request.nextUrl.searchParams.get('w'),