ghost rider

src/index.mjs

@@ -26,7 +26,7 @@ import { createI18n } from "./inc/i18n.mjs";
 import { safeDeleteMediaFile, purgeExpiredUploads } from "./inc/lib_delete.mjs";
 
 import security from "./inc/security.mjs";
-import { initPrivateItems, getPrivateItemFromPath, isPrivateItemPath, render502 } from "./inc/private_items.mjs";
+import { initPrivateItems, getPrivateItemFromPath, isPrivateItemPath, render502, render451 } from "./inc/private_items.mjs";
 
 import { createRequire } from 'module';
 const _require = createRequire(import.meta.url);
@@ -87,7 +87,7 @@ const _rcEnabled = !!(cfg.recaptcha && cfg.recaptcha.enabled && cfg.recaptcha.si
 const _rcSiteKey = (cfg.recaptcha && cfg.recaptcha.site_key) || '';
 
 function getGateLoginInjection(req) {
-  const rcEnabled = _rcEnabled && !lib.isOnionRequest(req);
+  const rcEnabled = _rcEnabled && !lib.isOnionRequest(req) && !lib.isLocalhostRequest(req);
   return `
 <div id="hot-corner" style="position:fixed;bottom:0;left:0;width:20px;height:20px;z-index:9999;"></div>
 
@@ -726,6 +726,41 @@ process.on('uncaughtException', err => {
     if (req.url.pathname.match(/^\/(b|c|t|ca|a|memes)\//) || req.url.pathname.startsWith('/s/emojis/')) {
       const privItem = getPrivateItemFromPath(req.url.pathname);
       if (privItem) {
+        if (privItem.isUnavailable) {
+          // Unavailable item (visibility === 3):
+          // Direct URLs MUST serve 451 when requested by non-admins (or without a session)
+          let isAdmin = false;
+          if (req.cookies?.session) {
+            const _sessionHash = lib.sha256(req.cookies.session);
+            let user = _scGet(_sessionHash);
+            if (!user) {
+              const urows = await db`
+                select "user".id, "user".user, "user".admin, "user".is_moderator, "user".banned, "user".ban_expires
+                from "user_sessions"
+                left join "user" on "user".id = "user_sessions".user_id
+                where "user_sessions".session = ${_sessionHash}
+                limit 1
+              `;
+              if (urows.length > 0) {
+                user = urows[0];
+                _scSet(_sessionHash, user);
+              }
+            }
+            if (user && !user.banned && user.admin) {
+              isAdmin = true;
+            }
+          }
+
+          if (!isAdmin) {
+            render451(req, res);
+            req.url.pathname = '/unavailable_item_bypass';
+            return;
+          }
+
+          res.setHeader('Cache-Control', 'private, no-cache, no-store, must-revalidate');
+          return;
+        }
+
         // Private item (visibility === 2):
         // Direct URLs MUST serve 502 when requested without a session (or by unauthorized users),
         // regardless of the protect_files setting.
@@ -1693,7 +1728,7 @@ process.on('uncaughtException', err => {
     const defaultRecaptcha = !!(cfg.recaptcha && cfg.recaptcha.enabled && cfg.recaptcha.site_key);
     let perRequestRecaptcha = defaultRecaptcha;
 
-    if (effectiveReq && lib.isOnionRequest(effectiveReq)) {
+    if (effectiveReq && (lib.isOnionRequest(effectiveReq) || lib.isLocalhostRequest(effectiveReq))) {
       perRequestRecaptcha = false;
     } else if (data && typeof data.recaptcha_enabled === 'boolean') {
       perRequestRecaptcha = data.recaptcha_enabled;