web-player: fix open redirect via returnTo, require SESSION_SECRET and validate API inputs

2026-09-24 04:58:08 +02:00
parent b2f450dcf7
commit 3e546d4a1e
12 changed files with 64 additions and 13 deletions
@@ -10,7 +10,9 @@ export async function proxyCoverImage(
 ): Promise<Response> {
 	const safeSize = size && ALLOWED_SIZES.has(size) ? size : 'medium';

-	const upstream = await fetch(`${apiConfig.baseUrl}/${kind}/${id}/cover?size=${safeSize}`);
+	const upstream = await fetch(
+		`${apiConfig.baseUrl}/${kind}/${encodeURIComponent(id)}/cover?size=${safeSize}`
+	);

 	if (!upstream.ok) {
 		return new Response(null, { status: upstream.status });