koü

src/inc/locales/en.json

@@ -43,7 +43,7 @@
     "url_tab_yt": "URL / YouTube",
     "url_placeholder": "Paste a URL to download...",
     "url_placeholder_yt": "Paste a URL or YouTube link...",
-    "url_placeholder_shitpost": "Paste multiple URLs here (one per line)...",
+    "url_placeholder_shitpost": "Paste a URL or YouTube link...",
     "drop_here": "Drop your file here",
     "admin_boost": "Admin Boost",
     "custom_thumbnail": "Custom Thumbnail",

src/inc/routes/index.mjs

@@ -13,10 +13,15 @@ const auth = async (req, res, next) => {
 };
 
 export default (router, tpl) => {
-  router.get(/\/user\/(?<user>[^/]+)\/?$/, async (req, res) => {
+  router.get(/^\/user\/(?<user>[^/]+)\/?$/, async (req, res) => {
     // When anonymization is active, user profiles must not be accessible without an authenticated regular session
+    // But allow anon users to view their own profile
     if (isAnonymizeSession(req.session)) {
-      return req.session ? res.redirect('/') : res.redirect('/login');
+      const requestedUser = decodeURIComponent(req.params.user).toLowerCase();
+      const sessionUser = (req.session?.user || req.session?.login || '').toLowerCase();
+      if (requestedUser !== sessionUser) {
+        return req.session ? res.redirect('/') : res.redirect('/login');
+      }
     }
     const user = decodeURIComponent(req.params.user);
     const mime = req.cookies.mime !== undefined ? req.cookies.mime : (req.query?.mime || req.url.qs?.mime || null);