administrator/frigate
1
0
Fork 0
mirror of https://github.com/blakeblackshear/frigate.git synced 2026-07-15 16:31:14 +03:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

validate preview filename and camera access

Browse Source
This commit is contained in:
Josh Hawkins 2026-03-19 09:17:06 -05:00
parent d11c26970d
commit f9a16d97aa
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
frigate/api/media.py
View File

@ -1893,7 +1893,7 @@ async def review_preview(
"/preview/{file_name}/thumbnail.webp", "/preview/{file_name}/thumbnail.webp",
dependencies=[Depends(allow_any_authenticated())], dependencies=[Depends(allow_any_authenticated())],
) )
def preview_thumbnail(file_name: str): async def preview_thumbnail(request: Request, file_name: str):
"""Get a thumbnail from the cached preview frames.""" """Get a thumbnail from the cached preview frames."""
if len(file_name) > 1000: if len(file_name) > 1000:
return JSONResponse( return JSONResponse(
@ -1903,6 +1903,15 @@ def preview_thumbnail(file_name: str):
status_code=403, status_code=403,
) )
# Extract camera name from preview filename (format: preview_{camera}-{timestamp}.ext)
if not file_name.startswith("preview_"):
return JSONResponse(
content={"success": False, "message": "Invalid preview filename"},
status_code=400,
)
camera_name = file_name[len("preview_") :].split("-")[0]
await require_camera_access(camera_name, request=request)
safe_file_name_current = sanitize_filename(file_name) safe_file_name_current = sanitize_filename(file_name)
preview_dir = os.path.join(CACHE_DIR, "preview_frames") preview_dir = os.path.join(CACHE_DIR, "preview_frames")