authorgravatar for git@paperclover.netclover caruso <git@paperclover.net> 2025-12-23 14:18:14-08:00
committergravatar for git@paperclover.netclover caruso <git@paperclover.net> 2026-01-14 01:08:15-08:00
log898b567540e271981e6be16f337063ba7c9df934
treefc1c8a362605f6987f33ab7057ba93a0e943927b
parent18dc72c445e5feaed852e15d649d21e28992cb81
signature Commit is signed but in an unrecognized format.

chore(file-viewer): stricter user agent check

1 files changed, 14 insertions(+), 2 deletions(-)

src/file-viewer/backend.tsx+14-2
...@@ -13,8 +13,20 @@ app.get("/file/*", async (c, next) => {...@@ -13,8 +13,20 @@ app.get("/file/*", async (c, next) => {
13 const ua = c.req.header("User-Agent")?.toLowerCase() ?? "";13 const ua = c.req.header("User-Agent")?.toLowerCase() ?? "";
14 const lofi = ua.includes("msie") || false;14 const lofi = ua.includes("msie") || false;
1515
16 // Discord ignores 'robots.txt' which violates the license agreement.16 // Some robots ignore 'robots.txt' which violates the license agreement.
17 if (ua.includes("discordbot")) return c.body("Forbidden", 403);17 if (
18 (!ua.startsWith("mozilla/")) ||
19 ua.includes("headless") ||
20 ua.includes("discord")
21 ) {
22 return c.body(
23 "Forbidden\n\nYour user agent, " + JSON.stringify(ua) +
24 ", appears to be an automated. Please do not automate " +
25 "access into my file viewer. I do not appreciate scraping. " +
26 "Instead, please view manually in a standard web browser.",
27 403,
28 );
29 }
1830
19 let rawFilePath = c.req.path.slice(5) || "/";31 let rawFilePath = c.req.path.slice(5) || "/";
2032