Merge branch 'develop' into notification-read-api

2022-01-01 23:01:21 +09:00
parent 5c495c0bcf 158dd49b3d
commit a70d9d2034
60 changed files with 511 additions and 468 deletions
--- a/packages/backend/src/server/proxy/proxy-media.ts
+++ b/packages/backend/src/server/proxy/proxy-media.ts
@@ -19,6 +19,7 @@ export async function proxyMedia(ctx: Koa.Context) {

 		const { mime, ext } = await detectType(path);

+		if (!mime.startsWith('image/')) throw 403;
 		if (!FILE_TYPE_BROWSERSAFE.includes(mime)) throw 403;

 		let image: IImage;