Koko210/immich-folio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: respect global exifOnHover config in API

Browse Source
This commit is contained in:
ralksta
2026-03-07 08:19:20 +01:00
parent e394fe84a0
commit e0bf02b31d
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
app/api/exif/[id]/route.ts
View File

@@ -8,8 +8,16 @@
import { NextResponse } from 'next/server'; import { NextResponse } from 'next/server';
import { immich } from '@/lib/immich'; import { immich } from '@/lib/immich';
import { decodeAssetId } from '@/lib/tokens'; import { decodeAssetId } from '@/lib/tokens';
import { getConfig } from '@/lib/config';
export async function GET(_request: Request, { params }: { params: Promise<{ id: string }> }) { export async function GET(_request: Request, { params }: { params: Promise<{ id: string }> }) {
const config = getConfig();
// Security: If EXIF is globally disabled, do not serve it via API either
if (!config.exifOnHover) {
return NextResponse.json({ error: 'EXIF metadata is disabled' }, { status: 403 });
}
const { id: token } = await params; const { id: token } = await params;
// Decode the opaque token back to an Immich asset ID // Decode the opaque token back to an Immich asset ID