From 691e0c359259e120f779604622bf31f6098565ce Mon Sep 17 00:00:00 2001
From: brunob <bruno@eliaz.fr>
Date: Thu, 12 May 2022 15:35:09 +0200
Subject: [PATCH 1/3] =?UTF-8?q?=E2=9C=A8=20Add=20a=20config=20flag=20to=20?=
 =?UTF-8?q?disable=20API?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

fix #129
---
 lib/Lutim/Controller/Image.pm | 14 ++++++++++++++
 lib/Lutim/DefaultConfig.pm    |  1 +
 lutim.conf.template           |  4 ++++
 3 files changed, 19 insertions(+)

diff --git a/lib/Lutim/Controller/Image.pm b/lib/Lutim/Controller/Image.pm
index 6441f9a..8593e75 100644
--- a/lib/Lutim/Controller/Image.pm
+++ b/lib/Lutim/Controller/Image.pm
@@ -287,6 +287,20 @@ sub add {
     my $keep_exif = $c->param('keep-exif');
     my $wm        = $c->param('watermark');
 
+    if ($c->config('disable_api')) {
+        my $msg = $c->l('Sorry, the API is disabled');
+        $c->app->log->info('Blocked API call for '.$ip);
+        return $c->respond_to(
+            json => { json => { success => Mojo::JSON->false, msg => $msg } },
+            any  => sub {
+                shift->render(
+                    template => 'index',
+                    msg      => $msg,
+                );
+            }
+        );
+    }
+
     if(!defined($c->stash('stop_upload'))) {
         if (defined($file_url) && $file_url) {
             if (is_http_uri($file_url) || is_https_uri($file_url)) {
diff --git a/lib/Lutim/DefaultConfig.pm b/lib/Lutim/DefaultConfig.pm
index e93a981..4765b59 100644
--- a/lib/Lutim/DefaultConfig.pm
+++ b/lib/Lutim/DefaultConfig.pm
@@ -22,6 +22,7 @@ our $default_config = {
     watermark_default   => 'none',
     watermark_enforce   => 'none',
     theme               => 'default',
+    disable_api            => 0,
     dbtype              => 'sqlite',
     db_path             => 'lutim.db',
     max_files_in_zip    => 15,
diff --git a/lutim.conf.template b/lutim.conf.template
index 4cde96e..e3b389b 100644
--- a/lutim.conf.template
+++ b/lutim.conf.template
@@ -135,6 +135,10 @@
     # optional, defaut is /
     #prefix            => '/',
 
+    # if set to 1, Lutim will try to prevent its use without using the web interface
+    # optional, default is 0
+    #disable_api => 0,
+
     # choose what database you want to use
     # valid choices are sqlite and postgresql (all lowercase)
     # optional, default is sqlite

From 3a0f39761cb803564306144fe99e48abdf2402b4 Mon Sep 17 00:00:00 2001
From: Luc Didry <luc@framasoft.org>
Date: Thu, 12 May 2022 14:19:07 +0000
Subject: [PATCH 2/3] =?UTF-8?q?Tester=20aussi=20le=20referer=20sans=20quoi?=
 =?UTF-8?q?=20=C3=A7a=20ne=20peut=20pas=20fonctionner=20(=C3=A0=20squasher?=
 =?UTF-8?q?=20avec=20le=20commit=20pr=C3=A9c=C3=A9dent).?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 lib/Lutim/Controller/Image.pm | 26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/lib/Lutim/Controller/Image.pm b/lib/Lutim/Controller/Image.pm
index 8593e75..308a7a6 100644
--- a/lib/Lutim/Controller/Image.pm
+++ b/lib/Lutim/Controller/Image.pm
@@ -288,19 +288,21 @@ sub add {
     my $wm        = $c->param('watermark');
 
     if ($c->config('disable_api')) {
-        my $msg = $c->l('Sorry, the API is disabled');
-        $c->app->log->info('Blocked API call for '.$ip);
-        return $c->respond_to(
-            json => { json => { success => Mojo::JSON->false, msg => $msg } },
-            any  => sub {
-                shift->render(
-                    template => 'index',
-                    msg      => $msg,
-                );
-            }
-        );
+        $unauthorized_api = (!defined($c->req->headers->referrer) || Mojo::URL->new($c->req->headers->referrer)->host ne Mojo::URL->new('https://'.$c->req->headers->host)->host);
+        if ($unauthorized_api) {
+            my $msg = $c->l('Sorry, the API is disabled');
+            $c->app->log->info('Blocked API call for '.$ip);
+            return $c->respond_to(
+                json => { json => { success => Mojo::JSON->false, msg => $msg } },
+                any  => sub {
+                    shift->render(
+                        template => 'index',
+                        msg      => $msg,
+                    );
+                }
+            );
+        }
     }
-
     if(!defined($c->stash('stop_upload'))) {
         if (defined($file_url) && $file_url) {
             if (is_http_uri($file_url) || is_https_uri($file_url)) {

From 34be40d9284036701a38516cc78ed83300a5bd52 Mon Sep 17 00:00:00 2001
From: Luc Didry <luc@framasoft.org>
Date: Mon, 27 Feb 2023 12:27:38 +0000
Subject: [PATCH 3/3] Fix use of `$ip`

---
 lib/Lutim/Controller/Image.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/Lutim/Controller/Image.pm b/lib/Lutim/Controller/Image.pm
index 308a7a6..d56ba4c 100644
--- a/lib/Lutim/Controller/Image.pm
+++ b/lib/Lutim/Controller/Image.pm
@@ -291,7 +291,7 @@ sub add {
         $unauthorized_api = (!defined($c->req->headers->referrer) || Mojo::URL->new($c->req->headers->referrer)->host ne Mojo::URL->new('https://'.$c->req->headers->host)->host);
         if ($unauthorized_api) {
             my $msg = $c->l('Sorry, the API is disabled');
-            $c->app->log->info('Blocked API call for '.$ip);
+            $c->app->log->info('Blocked API call for '.$c->ip(1));
             return $c->respond_to(
                 json => { json => { success => Mojo::JSON->false, msg => $msg } },
                 any  => sub {