gsdf

2026-09-12 10:10:34 +02:00
parent 217f1be72d
commit 53055ea5c6
35 changed files with 2261 additions and 138 deletions
@@ -120,6 +120,10 @@ export const handleUpload = async (req, res, self) => {
        return sendJson(res, { success: false, msg: 'Unauthorized' }, 401);
    }

+    if (req.session.is_anon || (req.session.user && req.session.user.startsWith('anon_'))) {
+        return sendJson(res, { success: false, msg: 'Uploading requires a registered account' }, 403);
+    }
+
    // CSRF validation — required for browser sessions, skipped for API key auth.
    if (!req.session.api_key_auth) {
        const csrfToken = req.headers['x-csrf-token'];