mirror of
https://github.com/Kareadita/Kavita.git
synced 2025-05-24 00:52:23 -04:00
* Updated ngx-extended-pdf-viewer to 14.5.2 + misc security vuln * Hooked up remove from want to read AND fixed a bug in the logic that was removing everything BUT what was passed. Allow for bookmarks to have date info for better ordering. * Implemented a quick way to set darkneses level on manga reader for when nightlight just isn't dark enough * Added Japanese Series name support in the Parser * Updated our security file with our Huntr. * Fixed a security vulnerability where through the API, an unauthorized user could delete/modify reading lists that did not belong to them. Fixed a bug where when creating a reading list with the name of another users, the API would throw an exception (but reading list would still get created) * Ensure all reading list apis are authorized * Ensured all APIs require authentication, except those that explicitly don't. All APIs are default requiring Authentication. Fixed a security vulnerability which would allow a user to take over an admin account. * Fixed a bug where cover-upload would accept filenames that were not expected. * Explicitly check that a user has access to the pdf file before we serve it back. * Enabled lock out when invalid user auth occurs. After 5 invalid auths, the user account will be locked out for 10 mins.
151 lines
7.5 KiB
C#
151 lines
7.5 KiB
C#
using System.IO;
|
|
using System.Threading.Tasks;
|
|
using API.Data;
|
|
using API.Entities.Enums;
|
|
using API.Services;
|
|
using Microsoft.AspNetCore.Authorization;
|
|
using Microsoft.AspNetCore.Mvc;
|
|
|
|
namespace API.Controllers
|
|
{
|
|
/// <summary>
|
|
/// Responsible for servicing up images stored in Kavita for entities
|
|
/// </summary>
|
|
public class ImageController : BaseApiController
|
|
{
|
|
private readonly IUnitOfWork _unitOfWork;
|
|
private readonly IDirectoryService _directoryService;
|
|
private const int ImageCacheSeconds = 1 * 60;
|
|
|
|
/// <inheritdoc />
|
|
public ImageController(IUnitOfWork unitOfWork, IDirectoryService directoryService)
|
|
{
|
|
_unitOfWork = unitOfWork;
|
|
_directoryService = directoryService;
|
|
}
|
|
|
|
/// <summary>
|
|
/// Returns cover image for Chapter
|
|
/// </summary>
|
|
/// <param name="chapterId"></param>
|
|
/// <returns></returns>
|
|
[HttpGet("chapter-cover")]
|
|
[ResponseCache(Duration = ImageCacheSeconds, Location = ResponseCacheLocation.Client, NoStore = false)]
|
|
public async Task<ActionResult> GetChapterCoverImage(int chapterId)
|
|
{
|
|
var path = Path.Join(_directoryService.CoverImageDirectory, await _unitOfWork.ChapterRepository.GetChapterCoverImageAsync(chapterId));
|
|
if (string.IsNullOrEmpty(path) || !_directoryService.FileSystem.File.Exists(path)) return BadRequest($"No cover image");
|
|
var format = _directoryService.FileSystem.Path.GetExtension(path).Replace(".", "");
|
|
|
|
return PhysicalFile(path, "image/" + format, _directoryService.FileSystem.Path.GetFileName(path));
|
|
}
|
|
|
|
/// <summary>
|
|
/// Returns cover image for Volume
|
|
/// </summary>
|
|
/// <param name="volumeId"></param>
|
|
/// <returns></returns>
|
|
[HttpGet("volume-cover")]
|
|
[ResponseCache(Duration = ImageCacheSeconds, Location = ResponseCacheLocation.Client, NoStore = false)]
|
|
public async Task<ActionResult> GetVolumeCoverImage(int volumeId)
|
|
{
|
|
var path = Path.Join(_directoryService.CoverImageDirectory, await _unitOfWork.VolumeRepository.GetVolumeCoverImageAsync(volumeId));
|
|
if (string.IsNullOrEmpty(path) || !_directoryService.FileSystem.File.Exists(path)) return BadRequest($"No cover image");
|
|
var format = _directoryService.FileSystem.Path.GetExtension(path).Replace(".", "");
|
|
|
|
return PhysicalFile(path, "image/" + format, _directoryService.FileSystem.Path.GetFileName(path));
|
|
}
|
|
|
|
/// <summary>
|
|
/// Returns cover image for Series
|
|
/// </summary>
|
|
/// <param name="seriesId">Id of Series</param>
|
|
/// <returns></returns>
|
|
[ResponseCache(Duration = ImageCacheSeconds, Location = ResponseCacheLocation.Client, NoStore = false)]
|
|
[HttpGet("series-cover")]
|
|
public async Task<ActionResult> GetSeriesCoverImage(int seriesId)
|
|
{
|
|
var path = Path.Join(_directoryService.CoverImageDirectory, await _unitOfWork.SeriesRepository.GetSeriesCoverImageAsync(seriesId));
|
|
if (string.IsNullOrEmpty(path) || !_directoryService.FileSystem.File.Exists(path)) return BadRequest($"No cover image");
|
|
var format = _directoryService.FileSystem.Path.GetExtension(path).Replace(".", "");
|
|
|
|
return PhysicalFile(path, "image/" + format, _directoryService.FileSystem.Path.GetFileName(path));
|
|
}
|
|
|
|
/// <summary>
|
|
/// Returns cover image for Collection Tag
|
|
/// </summary>
|
|
/// <param name="collectionTagId"></param>
|
|
/// <returns></returns>
|
|
[HttpGet("collection-cover")]
|
|
[ResponseCache(Duration = ImageCacheSeconds, Location = ResponseCacheLocation.Client, NoStore = false)]
|
|
public async Task<ActionResult> GetCollectionCoverImage(int collectionTagId)
|
|
{
|
|
var path = Path.Join(_directoryService.CoverImageDirectory, await _unitOfWork.CollectionTagRepository.GetCoverImageAsync(collectionTagId));
|
|
if (string.IsNullOrEmpty(path) || !_directoryService.FileSystem.File.Exists(path)) return BadRequest($"No cover image");
|
|
var format = _directoryService.FileSystem.Path.GetExtension(path).Replace(".", "");
|
|
|
|
return PhysicalFile(path, "image/" + format, _directoryService.FileSystem.Path.GetFileName(path));
|
|
}
|
|
|
|
/// <summary>
|
|
/// Returns cover image for a Reading List
|
|
/// </summary>
|
|
/// <param name="readingListId"></param>
|
|
/// <returns></returns>
|
|
[HttpGet("readinglist-cover")]
|
|
[ResponseCache(Duration = ImageCacheSeconds, Location = ResponseCacheLocation.Client, NoStore = false)]
|
|
public async Task<ActionResult> GetReadingListCoverImage(int readingListId)
|
|
{
|
|
var path = Path.Join(_directoryService.CoverImageDirectory, await _unitOfWork.ReadingListRepository.GetCoverImageAsync(readingListId));
|
|
if (string.IsNullOrEmpty(path) || !_directoryService.FileSystem.File.Exists(path)) return BadRequest($"No cover image");
|
|
var format = _directoryService.FileSystem.Path.GetExtension(path).Replace(".", "");
|
|
|
|
return PhysicalFile(path, "image/" + format, _directoryService.FileSystem.Path.GetFileName(path));
|
|
}
|
|
|
|
/// <summary>
|
|
/// Returns image for a given bookmark page
|
|
/// </summary>
|
|
/// <remarks>This request is served unauthenticated, but user must be passed via api key to validate</remarks>
|
|
/// <param name="chapterId"></param>
|
|
/// <param name="pageNum">Starts at 0</param>
|
|
/// <param name="apiKey">API Key for user. Needed to authenticate request</param>
|
|
/// <returns></returns>
|
|
[HttpGet("bookmark")]
|
|
[ResponseCache(Duration = ImageCacheSeconds, Location = ResponseCacheLocation.Client, NoStore = false)]
|
|
public async Task<ActionResult> GetBookmarkImage(int chapterId, int pageNum, string apiKey)
|
|
{
|
|
var userId = await _unitOfWork.UserRepository.GetUserIdByApiKeyAsync(apiKey);
|
|
var bookmark = await _unitOfWork.UserRepository.GetBookmarkForPage(pageNum, chapterId, userId);
|
|
if (bookmark == null) return BadRequest("Bookmark does not exist");
|
|
|
|
var bookmarkDirectory =
|
|
(await _unitOfWork.SettingsRepository.GetSettingAsync(ServerSettingKey.BookmarkDirectory)).Value;
|
|
var file = new FileInfo(Path.Join(bookmarkDirectory, bookmark.FileName));
|
|
var format = Path.GetExtension(file.FullName).Replace(".", "");
|
|
|
|
return PhysicalFile(file.FullName, "image/" + format, Path.GetFileName(file.FullName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// Returns a temp coverupload image
|
|
/// </summary>
|
|
/// <param name="filename">Filename of file. This is used with upload/upload-by-url</param>
|
|
/// <returns></returns>
|
|
[AllowAnonymous]
|
|
[HttpGet("cover-upload")]
|
|
[ResponseCache(Duration = ImageCacheSeconds, Location = ResponseCacheLocation.Client, NoStore = false)]
|
|
public ActionResult GetCoverUploadImage(string filename)
|
|
{
|
|
if (filename.Contains("..")) return BadRequest("Invalid Filename");
|
|
|
|
var path = Path.Join(_directoryService.TempDirectory, filename);
|
|
if (string.IsNullOrEmpty(path) || !_directoryService.FileSystem.File.Exists(path)) return BadRequest($"File does not exist");
|
|
var format = _directoryService.FileSystem.Path.GetExtension(path).Replace(".", "");
|
|
|
|
return PhysicalFile(path, "image/" + format, _directoryService.FileSystem.Path.GetFileName(path));
|
|
}
|
|
}
|
|
}
|