feat: Authenticate media downloads

This is not strictly required by the spec, but it improves security to
require auth for media downloads on your homeserver. I enabled that on
my servers now and plan to MSC that soon. This is required for people on
my servers to see images and other content now.
This commit is contained in:
Nicolas Werner 2022-05-16 08:14:48 +02:00
parent a9d644cf93
commit 13b4598c83
1 changed files with 3 additions and 0 deletions

View File

@ -4256,6 +4256,7 @@ class Api {
if (allowRemote != null) 'allow_remote': allowRemote.toString(), if (allowRemote != null) 'allow_remote': allowRemote.toString(),
}); });
final request = Request('GET', baseUri!.resolveUri(requestUri)); final request = Request('GET', baseUri!.resolveUri(requestUri));
request.headers['authorization'] = 'Bearer ${bearerToken!}';
final response = await httpClient.send(request); final response = await httpClient.send(request);
final responseBody = await response.stream.toBytes(); final responseBody = await response.stream.toBytes();
if (response.statusCode != 200) unexpectedResponse(response, responseBody); if (response.statusCode != 200) unexpectedResponse(response, responseBody);
@ -4289,6 +4290,7 @@ class Api {
if (allowRemote != null) 'allow_remote': allowRemote.toString(), if (allowRemote != null) 'allow_remote': allowRemote.toString(),
}); });
final request = Request('GET', baseUri!.resolveUri(requestUri)); final request = Request('GET', baseUri!.resolveUri(requestUri));
request.headers['authorization'] = 'Bearer ${bearerToken!}';
final response = await httpClient.send(request); final response = await httpClient.send(request);
final responseBody = await response.stream.toBytes(); final responseBody = await response.stream.toBytes();
if (response.statusCode != 200) unexpectedResponse(response, responseBody); if (response.statusCode != 200) unexpectedResponse(response, responseBody);
@ -4360,6 +4362,7 @@ class Api {
if (allowRemote != null) 'allow_remote': allowRemote.toString(), if (allowRemote != null) 'allow_remote': allowRemote.toString(),
}); });
final request = Request('GET', baseUri!.resolveUri(requestUri)); final request = Request('GET', baseUri!.resolveUri(requestUri));
request.headers['authorization'] = 'Bearer ${bearerToken!}';
final response = await httpClient.send(request); final response = await httpClient.send(request);
final responseBody = await response.stream.toBytes(); final responseBody = await response.stream.toBytes();
if (response.statusCode != 200) unexpectedResponse(response, responseBody); if (response.statusCode != 200) unexpectedResponse(response, responseBody);