From 4b9214dbafaa84fec698679f75026ffaf2062872 Mon Sep 17 00:00:00 2001 From: Peter Meier Date: Mon, 18 May 2026 08:36:43 +0200 Subject: [PATCH] Fix FilesBlock: external URLs bypass /cms-files proxy getCmsFileUrl() returned /cms-files?src=... for all URLs including external ones. resolveCmsSource() rejects foreign hosts (SSRF guard), so external file links 404'd. External http(s) URLs now returned directly. Co-Authored-By: Claude Sonnet 4.6 --- src/lib/rusty-file.ts | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/lib/rusty-file.ts b/src/lib/rusty-file.ts index c66f680..c9e2af3 100644 --- a/src/lib/rusty-file.ts +++ b/src/lib/rusty-file.ts @@ -62,8 +62,13 @@ export interface CmsFileUrlOptions { /** * Lokale Datei-URL: /cms-files?src=…&name=…&dl=… * `src` = volle Datei-URL oder CMS-Asset-Pfad (`/api/assets/...`). + * Externe http(s)-URLs werden direkt zurückgegeben — der /cms-files-Proxy + * würde sie wegen SSRF-Schutz sowieso ablehnen. */ export function getCmsFileUrl(src: string, opts: CmsFileUrlOptions = {}): string { + if (src.startsWith('http://') || src.startsWith('https://')) { + return src; + } const params = new URLSearchParams(); params.set('src', src); if (opts.filename) params.set('name', opts.filename);