Debug removal of whitelist

2026-08-12 22:38:07 +02:00
1 changed files with 4 additions and 3 deletions
@@ -474,7 +474,8 @@ ALLOWED_COVER_DOMAINS = {
    "covers.openlibrary.org",
    "openlibrary.org",
    "lobid.org",
-    "www.googleapis.com"
+    "www.googleapis.com",
+    "www.westermann.de"
 }

 SENSITIVE_AUDIT_FIELDS = ["email", "username", "full_name", "phone", "borrower", "ip"]
@@ -10043,8 +10044,8 @@ def download_book_cover():
            return jsonify({"error": "Only public HTTPS URLs are allowed"}), 400

        # 2. SSRF Protection: Strict Allowlist Check
-        if parsed_url.netloc not in ALLOWED_COVER_DOMAINS:
-            return jsonify({"error": "Target host is not an allowed book cover provider"}), 403
+        # if parsed_url.netloc not in ALLOWED_COVER_DOMAINS:  # ---------------------------------------------- has to be implementet at a laterstage ---------------------------------------------------------------
+        #    return jsonify({"error": "Target host is not an allowed book cover provider"}), 403
        
        # Download the image (allow_redirects=False prevents redirecting to internal IPs)
        response = requests.get(image_url, stream=True, timeout=10, allow_redirects=False)