From 85f7bd1fc9265aab329f0f75dfa8a6dc949b4bae Mon Sep 17 00:00:00 2001
From: Jeppe B <2jepp9350@gmail.com>
Date: Mon, 1 Jun 2026 23:09:37 +0200
Subject: [PATCH] Require auth for direct /files/ downloads

---
 services/nginx/app/file_server.php | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/services/nginx/app/file_server.php b/services/nginx/app/file_server.php
index ca217eef..c0ae0b72 100644
--- a/services/nginx/app/file_server.php
+++ b/services/nginx/app/file_server.php
@@ -5,6 +5,21 @@ $isPreview = $_GET['preview'] ?? false;
 // Remove query string if present
 $file = strtok($file, '?');
 
+// Require authentication for direct /files/ access
+if (str_contains($file, '/files/')) {
+    $headers = getallheaders();
+    $token = $_GET['token'] ?? $_POST['token'] ?? ($headers['Authorization'] ?? null);
+    if (!empty($token)) {
+        $token = str_replace('Bearer ', '', $token);
+    }
+
+    if (empty($token) || !(new \classes\authentication())->validate_token($token)) {
+        header('HTTP/1.1 401 Unauthorized');
+        echo 'Unauthorized';
+        exit;
+    }
+}
+
 $isPDF = false;
 $isPDFStore = false;
 $isAttachment = false;
@@ -118,4 +133,4 @@ if (!$isPDF) {
     // Delete the file from /tmp after sending it
     unlink($file_path);
     exit;
-}
\ No newline at end of file
+}