sevenhill/Immich
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(server): require upload access for checksum duplicate check (#32559)

Browse Source 
* fix(server): require upload access for checksum duplicate check

* fix(server): use the upload access check for the checksum short circuit

(cherry picked from commit 5c02b17495947d7332cce13273226082bd8ae2a1)
This commit is contained in:
bo0tzz
2026-10-22 05:21:00 +03:00
committed by Codex
parent 67152772d2
commit d92248c664
2 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/src/services/asset-media.service.spec.ts
+8
View File
@@ -183,6 +183,14 @@ describe(AssetMediaService.name, () => {
await expect(sut.getUploadAssetIdByChecksum(authStub.admin)).resolves.toBe(undefined);
});
it('should reject a shared link without upload permission', async () => {
const auth = AuthFactory.from().sharedLink({ allowUpload: false }).build();
await expect(sut.getUploadAssetIdByChecksum(auth, file1.toString('hex'))).rejects.toBeInstanceOf(
BadRequestException,
);
expect(mocks.asset.getUploadAssetIdByChecksum).not.toHaveBeenCalled();
});
it('should handle a non-existent asset', async () => {
await expect(sut.getUploadAssetIdByChecksum(authStub.admin, file1.toString('hex'))).resolves.toBeUndefined();
expect(mocks.asset.getUploadAssetIdByChecksum).toHaveBeenCalledWith(authStub.admin.user.id, file1);
server/src/services/asset-media.service.ts
+2
View File
@@ -48,6 +48,8 @@ export class AssetMediaService extends BaseService {
return;
}
await this.requireAccess({ auth, permission: Permission.AssetUpload, ids: [auth.user.id] });
const assetId = await this.assetRepository.getUploadAssetIdByChecksum(auth.user.id, fromChecksum(checksum));
if (!assetId) {
return;