etkr4k/bedolaga-cabinet
1
0
Fork 0
mirror of https://github.com/chillpadclub/bedolaga-cabinet.git synced 2026-07-30 10:27:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): use signed media tokens for ticket attachments

Browse Source 
Backend now requires a signed, expiring token to download media (a raw file_id
404s). Carry the per-attachment `token` (and the legacy `media_token`) from the
ticket response through MessageMediaGrid and append it in ticketsApi.getMediaUrl,
so attachments keep rendering while leaked URLs expire. Must deploy together with
the backend change.
This commit is contained in:
c0mrade
2026-06-04 17:45:43 +03:00
parent b4f066942a
commit c6fc167d80
3 changed files with 19 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
src/components/tickets/MessageMediaGrid.tsx
View File

@@ -9,12 +9,15 @@ export interface MediaItem {
type: string;
file_id: string;
caption?: string | null;
/** Signed, expiring download token from the ticket response. */
token?: string | null;
}
interface MessageLike {
has_media?: boolean;
media_type?: string | null;
media_file_id?: string | null;
media_token?: string | null;
media_caption?: string | null;
media_items?: MediaItem[] | null;
}
@@ -33,6 +36,7 @@ function getItems(message: MessageLike): MediaItem[] {
type: message.media_type,
file_id: message.media_file_id,
caption: message.media_caption,
token: message.media_token,
},
];
}
@@ -113,7 +117,7 @@ export function MessageMediaGrid({
onClick={() => openFullscreen(originalIdx)}
>
<img
src={ticketsApi.getMediaUrl(item.file_id)}
src={ticketsApi.getMediaUrl(item.file_id, item.token)}
alt={item.caption || 'Attached photo'}
className="h-full w-full object-cover transition-opacity group-hover:opacity-90"
loading="lazy"
@@ -131,7 +135,7 @@ export function MessageMediaGrid({
{/* Non-photo media rendered inline */}
{otherItems.map((item) => {
const mediaUrl = ticketsApi.getMediaUrl(item.file_id);
const mediaUrl = ticketsApi.getMediaUrl(item.file_id, item.token);
if (item.type === 'video') {
return (
<div key={item.file_id}>
@@ -203,7 +207,10 @@ export function MessageMediaGrid({
onClick={closeFullscreen}
>
<img
src={ticketsApi.getMediaUrl(photoItems[fullscreenIndex].file_id)}
src={ticketsApi.getMediaUrl(
photoItems[fullscreenIndex].file_id,
photoItems[fullscreenIndex].token,
)}
alt={photoItems[fullscreenIndex].caption || 'Attached photo'}
className="max-h-full max-w-full object-contain"
style={{ touchAction: 'pinch-zoom' }}