Close data leaks: remove anonymous user creation, hide private playlists, validate uploads and clamp gateway ranges

2026-09-24 05:00:21 +02:00
parent c8fe28b07b
commit c8e9c7790e
34 changed files with 374 additions and 553 deletions
@@ -59,15 +59,18 @@ public class CreateTrackCommandHandler(
            return Error.Validation(description: $"Tags '{conflict.First}' and '{conflict.Second}' are not compatible.");
        }

+        if (request.PictureIntentId == request.AudioIntentId)
+            return Error.Validation(description: "Picture and audio must use different upload intents.");
+
        var pictureValidation = await uploadIntentValidator.ValidateAndLoadAsync(
            uploadIntentConfiguration,
-            request.PictureIntentId, request.UserId, cancellationToken);
+            request.PictureIntentId, request.UserId, UploadIntentPurpose.TrackPicture, cancellationToken);
        if (pictureValidation.IsError)
            return pictureValidation.Errors;

        var audioValidation = await uploadIntentValidator.ValidateAndLoadAsync(
            uploadIntentConfiguration,
-            request.AudioIntentId, request.UserId, cancellationToken);
+            request.AudioIntentId, request.UserId, UploadIntentPurpose.TrackAudio, cancellationToken);
        if (audioValidation.IsError)
            return audioValidation.Errors;