koü

src/inc/routes/index.mjs

@@ -13,10 +13,15 @@ const auth = async (req, res, next) => {
 };
 
 export default (router, tpl) => {
-  router.get(/\/user\/(?<user>[^/]+)\/?$/, async (req, res) => {
+  router.get(/^\/user\/(?<user>[^/]+)\/?$/, async (req, res) => {
     // When anonymization is active, user profiles must not be accessible without an authenticated regular session
+    // But allow anon users to view their own profile
     if (isAnonymizeSession(req.session)) {
-      return req.session ? res.redirect('/') : res.redirect('/login');
+      const requestedUser = decodeURIComponent(req.params.user).toLowerCase();
+      const sessionUser = (req.session?.user || req.session?.login || '').toLowerCase();
+      if (requestedUser !== sessionUser) {
+        return req.session ? res.redirect('/') : res.redirect('/login');
+      }
     }
     const user = decodeURIComponent(req.params.user);
     const mime = req.cookies.mime !== undefined ? req.cookies.mime : (req.query?.mime || req.url.qs?.mime || null);