gfsd

src/index.mjs

@@ -867,14 +867,55 @@ process.on('uncaughtException', err => {
       }
       // csrf_token is loaded from user_sessions table via the session query above
 
-      // Ban check
-      if (req.session.banned && !req.url.pathname.match(/^\/(banned|logout)(\/)?$/)) {
+      // Ban check (Session)
+      if (req.session && req.session.banned && !req.url.pathname.match(/^\/(banned|logout)(\/)?$/)) {
         const now = new Date();
         if (req.session.ban_expires && new Date(req.session.ban_expires) < now) {
           // Ban expired, lift it
           await db`update "user" set banned = false, ban_reason = null, ban_expires = null where id = ${+req.session.id}`;
           req.session.banned = false;
         } else {
+          if (req.headers['x-requested-with'] === 'XMLHttpRequest' || req.url.pathname.startsWith('/api/')) {
+            res.writeHead(403, { 'Content-Type': 'application/json' }).end(JSON.stringify({
+              success: false,
+              banned: true,
+              msg: 'YOU ARE BANNED!',
+              reason: req.session.ban_reason || 'Banned',
+              expires: req.session.ban_expires ? new Date(req.session.ban_expires).toLocaleString() : 'Permanent',
+              redirect: '/banned'
+            }));
+            req.url.pathname = '/ban_redirect_bypass';
+            return;
+          }
+          res.writeHead(307, {
+            "Location": "/banned"
+          }).end();
+          req.url.pathname = '/ban_redirect_bypass';
+          return;
+        }
+      }
+
+      // Ban check (IP and Fingerprint - applies to all requests, even without active session)
+      if (!req.url.pathname.match(/^\/(banned|logout|s\/|a\/|t\/|b\/|c\/|favicon\.ico)(\/)?$/)) {
+        const clientIp = security.getRealIP(req);
+        const ipBan = await security.isIpBanned(clientIp);
+        const fp = req.session?.fingerprint || req.session?.anon_fingerprint;
+        const fpBan = fp ? await security.isFingerprintBanned(fp) : null;
+        const banInfo = ipBan || fpBan;
+
+        if (banInfo) {
+          if (req.headers['x-requested-with'] === 'XMLHttpRequest' || req.url.pathname.startsWith('/api/')) {
+            res.writeHead(403, { 'Content-Type': 'application/json' }).end(JSON.stringify({
+              success: false,
+              banned: true,
+              msg: 'YOU ARE BANNED!',
+              reason: banInfo.reason || 'Banned',
+              expires: banInfo.expires ? new Date(banInfo.expires).toLocaleString() : 'Permanent',
+              redirect: '/banned'
+            }));
+            req.url.pathname = '/ban_redirect_bypass';
+            return;
+          }
           res.writeHead(307, {
             "Location": "/banned"
           }).end();