etkr4k/bedolaga-cabinet
1
0
Fork 0
mirror of https://github.com/chillpadclub/bedolaga-cabinet.git synced 2026-07-28 09:33:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): use signed media tokens for ticket attachments

Browse Source 
Backend now requires a signed, expiring token to download media (a raw file_id
404s). Carry the per-attachment `token` (and the legacy `media_token`) from the
ticket response through MessageMediaGrid and append it in ticketsApi.getMediaUrl,
so attachments keep rendering while leaked URLs expire. Must deploy together with
the backend change.
This commit is contained in:
c0mrade
2026-06-04 17:45:43 +03:00
parent b4f066942a
commit c6fc167d80
3 changed files with 19 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/api/tickets.ts
View File

@@ -79,9 +79,11 @@ export const ticketsApi = {
return response.data;
},
// Get media URL for display
getMediaUrl: (fileId: string): string => {
// Get media URL for display. The signed `token` comes from the ticket
// response and is required by the backend (a raw file_id alone 404s).
getMediaUrl: (fileId: string, token?: string | null): string => {
const baseUrl = import.meta.env.VITE_API_URL || '';
return `${baseUrl}/cabinet/media/${fileId}`;
const suffix = token ? `?token=${encodeURIComponent(token)}` : '';
return `${baseUrl}/cabinet/media/${fileId}${suffix}`;
},
};