From 057c51751577d23b9869e9dcd1d64f53b56768e4 Mon Sep 17 00:00:00 2001 From: AIIrondev Date: Wed, 12 Aug 2026 22:38:07 +0200 Subject: [PATCH] Debug removal of whitelist --- Web/app.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/Web/app.py b/Web/app.py index a687ca4..b728eaf 100755 --- a/Web/app.py +++ b/Web/app.py @@ -474,7 +474,8 @@ ALLOWED_COVER_DOMAINS = { "covers.openlibrary.org", "openlibrary.org", "lobid.org", - "www.googleapis.com" + "www.googleapis.com", + "www.westermann.de" } SENSITIVE_AUDIT_FIELDS = ["email", "username", "full_name", "phone", "borrower", "ip"] @@ -10043,8 +10044,8 @@ def download_book_cover(): return jsonify({"error": "Only public HTTPS URLs are allowed"}), 400 # 2. SSRF Protection: Strict Allowlist Check - if parsed_url.netloc not in ALLOWED_COVER_DOMAINS: - return jsonify({"error": "Target host is not an allowed book cover provider"}), 403 + # if parsed_url.netloc not in ALLOWED_COVER_DOMAINS: # ---------------------------------------------- has to be implementet at a laterstage --------------------------------------------------------------- + # return jsonify({"error": "Target host is not an allowed book cover provider"}), 403 # Download the image (allow_redirects=False prevents redirecting to internal IPs) response = requests.get(image_url, stream=True, timeout=10, allow_redirects=False)