From 3a0f39761cb803564306144fe99e48abdf2402b4 Mon Sep 17 00:00:00 2001
From: Luc Didry <luc@framasoft.org>
Date: Thu, 12 May 2022 14:19:07 +0000
Subject: [PATCH] =?UTF-8?q?Tester=20aussi=20le=20referer=20sans=20quoi=20?=
 =?UTF-8?q?=C3=A7a=20ne=20peut=20pas=20fonctionner=20(=C3=A0=20squasher=20?=
 =?UTF-8?q?avec=20le=20commit=20pr=C3=A9c=C3=A9dent).?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 lib/Lutim/Controller/Image.pm | 26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/lib/Lutim/Controller/Image.pm b/lib/Lutim/Controller/Image.pm
index 8593e75..308a7a6 100644
--- a/lib/Lutim/Controller/Image.pm
+++ b/lib/Lutim/Controller/Image.pm
@@ -288,19 +288,21 @@ sub add {
     my $wm        = $c->param('watermark');
 
     if ($c->config('disable_api')) {
-        my $msg = $c->l('Sorry, the API is disabled');
-        $c->app->log->info('Blocked API call for '.$ip);
-        return $c->respond_to(
-            json => { json => { success => Mojo::JSON->false, msg => $msg } },
-            any  => sub {
-                shift->render(
-                    template => 'index',
-                    msg      => $msg,
-                );
-            }
-        );
+        $unauthorized_api = (!defined($c->req->headers->referrer) || Mojo::URL->new($c->req->headers->referrer)->host ne Mojo::URL->new('https://'.$c->req->headers->host)->host);
+        if ($unauthorized_api) {
+            my $msg = $c->l('Sorry, the API is disabled');
+            $c->app->log->info('Blocked API call for '.$ip);
+            return $c->respond_to(
+                json => { json => { success => Mojo::JSON->false, msg => $msg } },
+                any  => sub {
+                    shift->render(
+                        template => 'index',
+                        msg      => $msg,
+                    );
+                }
+            );
+        }
     }
-
     if(!defined($c->stash('stop_upload'))) {
         if (defined($file_url) && $file_url) {
             if (is_http_uri($file_url) || is_https_uri($file_url)) {