gfsd

src/inc/routes/index.mjs

@@ -12,6 +12,10 @@ const auth = async (req, res, next) => {
 
 export default (router, tpl) => {
   router.get(/\/user\/(?<user>[^/]+)\/?$/, async (req, res) => {
+    // When guest anonymization is active, user profiles must not be accessible without a session
+    if (cfg.main.guest_anonymize && !req.session) {
+      return res.redirect('/login');
+    }
     const user = decodeURIComponent(req.params.user);
     const mime = req.cookies.mime !== undefined ? req.cookies.mime : (req.query?.mime || req.url.qs?.mime || null);
 
@@ -223,6 +227,11 @@ export default (router, tpl) => {
       return res.reply({ code: 404, body: tpl.render('error', { message: 'Not found', tmp: null }, req) });
     }
 
+    // When guest anonymization is active, user gallery pages must require authentication
+    if (cfg.main.guest_anonymize && !req.session && req.params.user && req.params.mode) {
+      return res.redirect('/login');
+    }
+
     // Auto-persist strict mode from URL to session if it's there
     if (req.session && (req.query?.strict !== undefined || req.url.qs?.strict !== undefined)) {
       req.session.strict_mode = (req.query?.strict === '1' || req.url.qs?.strict === '1');
@@ -384,6 +393,10 @@ export default (router, tpl) => {
       // Hall columns for display
       data.halls_slugs = Array.isArray(item.halls) ? item.halls.map(h => h.slug).join(',') : '';
       data.user_halls_slugs = Array.isArray(item.user_halls) ? item.user_halls.map(h => h.slug).join(',') : '';
+      // When guest anonymization is active, suppress source URL from the info modal
+      if (cfg.main.guest_anonymize && !req.session && item.src) {
+        item.src = null;
+      }
       // Precomputed for template engine compatibility (avoids nested { } inside {{ }})
       data.item_rating_class = item.is_nsfl ? 'is-nsfl' : (item.is_nsfw ? 'is-nsfw' : (item.is_sfw ? 'is-sfw' : 'is-untagged'));
       data.item_rating_label = item.is_nsfl ? 'NSFL' : (item.is_nsfw ? 'NSFW' : (item.is_sfw ? 'SFW' : '?'));