From fb62363cb8ffb741edc18932ba62750be149665c Mon Sep 17 00:00:00 2001 From: viktorstrate Date: Thu, 20 Feb 2020 17:31:41 +0100 Subject: [PATCH] Protect photos from public access --- api/routes/photos.go | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/api/routes/photos.go b/api/routes/photos.go index e7815133..5e9307d8 100644 --- a/api/routes/photos.go +++ b/api/routes/photos.go @@ -8,6 +8,7 @@ import ( "os" "github.com/go-chi/chi" + "github.com/viktorstrate/photoview/api/graphql/auth" "github.com/viktorstrate/photoview/api/graphql/models" ) @@ -30,6 +31,28 @@ func PhotoRoutes(db *sql.DB) chi.Router { return } + user := auth.UserFromContext(r.Context()) + if user != nil { + row := db.QueryRow("SELECT owner_id FROM album WHERE album.album_id = ?", album_id) + var owner_id int + + if err := row.Scan(&owner_id); err != nil { + w.WriteHeader(http.StatusInternalServerError) + w.Write([]byte("internal server error")) + return + } + + if owner_id != user.UserID { + w.WriteHeader(http.StatusForbidden) + w.Write([]byte("invalid credentials")) + return + } + } else { + w.WriteHeader(http.StatusForbidden) + w.Write([]byte("unauthorized")) + return + } + w.Header().Set("Content-Type", content_type) var file *os.File