g

src/inc/routes/apiv2/settings.mjs

@@ -355,6 +355,9 @@ export default router => {
 
     // Update Default Upload Visibility preference
     group.put(/\/default_upload_visibility/, lib.loggedin, async (req, res) => {
+      if (cfg.allow_user_upload_visibility === false || cfg.websrv?.allow_user_upload_visibility === false) {
+        return res.json({ success: false, msg: 'Custom upload visibility is disabled by the administrator' }, 403);
+      }
       const vis = parseInt(req.post.default_upload_visibility, 10);
       if (isNaN(vis) || ![0, 1, 2].includes(vis)) {
         return res.json({ success: false, msg: 'Invalid visibility option' }, 400);

src/inc/routes/apiv2/upload.mjs

@@ -139,12 +139,25 @@ import { getManualApproval, getMinTags, getBypassDuplicateCheck } from "../../se
 
 const getTargetVisibility = (req, postVis) => {
     if (cfg.enable_private_uploads === false) return 0;
+
+    const sysDefault = (typeof cfg.default_upload_visibility === 'number')
+        ? cfg.default_upload_visibility
+        : (typeof cfg.websrv?.default_upload_visibility === 'number' ? cfg.websrv.default_upload_visibility : 0);
+
+    const allowUserOverride = cfg.allow_user_upload_visibility !== false && cfg.websrv?.allow_user_upload_visibility !== false;
+
+    if (!allowUserOverride) {
+        return sysDefault;
+    }
+
     const rawHeader = req.headers ? req.headers['x-upload-visibility'] : null;
     const val = (rawHeader || postVis || '').toString().trim().toLowerCase();
     if (val === 'private' || val === '2') return 2;
     if (val === 'unlisted' || val === '1') return 1;
     if (val === 'public' || val === '0') return 0;
-    return req.session?.default_upload_visibility || 0;
+    return (req.session?.default_upload_visibility !== undefined && req.session?.default_upload_visibility !== null)
+        ? req.session.default_upload_visibility
+        : sysDefault;
 };
 
 // Collect request body as buffer with debug logging