hdf

src/inc/routes/apiv2/index.mjs

@@ -11,6 +11,7 @@ import audit from '../../audit.mjs';
 import { parseMultipart, collectBody } from '../../multipart.mjs';
 import { purgeExpiredUploads } from '../../lib_delete.mjs';
 import { calculateExpiresAt } from './upload.mjs';
+import { addPrivateItem, removePrivateItem } from '../../private_items.mjs';
 
 const allowedMimes = ["audio", "image", "video", "%"];
 const getGlobalfilter = () => {
@@ -1311,7 +1312,7 @@ export default router => {
     });
 
     group.post(/\/item\/visibility$/, lib.loggedin, async (req, res) => {
-        if (cfg.enable_private_uploads === false) {
+        if (cfg.enable_private_uploads === false && !req.session?.admin) {
             return res.json({ success: false, msg: 'Private uploads feature disabled' }, 403);
         }
         const postid = req.post?.postid || req.post?.id || req.body?.postid || req.body?.id;
@@ -1322,7 +1323,7 @@ export default router => {
 
         const isNumeric = /^\d+$/.test(String(postid));
         const item = await db`
-            SELECT id, slug, username, visibility
+            SELECT id, slug, username, visibility, dest
             FROM items
             WHERE ${isNumeric ? db`id = ${+postid}` : db`slug = ${String(postid)}`} AND active = true AND is_deleted = false
             LIMIT 1
@@ -1341,6 +1342,12 @@ export default router => {
 
         await db`UPDATE items SET visibility = ${visibility} WHERE id = ${item[0].id}`;
 
+        if (visibility === 2) {
+            addPrivateItem(item[0].id, item[0].dest, item[0].username);
+        } else {
+            removePrivateItem(item[0].id, item[0].dest);
+        }
+
         f0cklib.clearCountCache();
 
         return res.json({