🔀 Merge branch 'issue_129' into 'development'

✨ Add a config flag to disable API

See merge request fiat-tux/hat-softwares/lutim!87

lib/Lutim/Controller/Image.pm

@@ -287,6 +287,22 @@ sub add {
     my $keep_exif = $c->param('keep-exif');
     my $wm        = $c->param('watermark');
 
+    if ($c->config('disable_api')) {
+        $unauthorized_api = (!defined($c->req->headers->referrer) || Mojo::URL->new($c->req->headers->referrer)->host ne Mojo::URL->new('https://'.$c->req->headers->host)->host);
+        if ($unauthorized_api) {
+            my $msg = $c->l('Sorry, the API is disabled');
+            $c->app->log->info('Blocked API call for '.$c->ip(1));
+            return $c->respond_to(
+                json => { json => { success => Mojo::JSON->false, msg => $msg } },
+                any  => sub {
+                    shift->render(
+                        template => 'index',
+                        msg      => $msg,
+                    );
+                }
+            );
+        }
+    }
     if(!defined($c->stash('stop_upload'))) {
         if (defined($file_url) && $file_url) {
             if (is_http_uri($file_url) || is_https_uri($file_url)) {

lib/Lutim/DefaultConfig.pm

@@ -22,6 +22,7 @@ our $default_config = {
     watermark_default   => 'none',
     watermark_enforce   => 'none',
     theme               => 'default',
+    disable_api            => 0,
     dbtype              => 'sqlite',
     db_path             => 'lutim.db',
     max_files_in_zip    => 15,

lutim.conf.template

@@ -135,6 +135,10 @@
     # optional, defaut is /
     #prefix            => '/',
 
+    # if set to 1, Lutim will try to prevent its use without using the web interface
+    # optional, default is 0
+    #disable_api => 0,
+
     # choose what database you want to use
     # valid choices are sqlite and postgresql (all lowercase)
     # optional, default is sqlite