From 778cb72c8a0902bd0b8159ebd3bb7eff93f28c83 Mon Sep 17 00:00:00 2001 From: grm Date: Mon, 14 Sep 2026 23:51:55 +0300 Subject: Turn the image library into a file library, with a per-blog upload limit Bloggers want to attach PDFs, archives, audio and other files to posts, not only images. The Images tab becomes Files: any type is accepted, listed by kind with search, paging, rename and multi-file upload, and the editor's paste/drop/"Insert file" takes anything (images are shown, everything else becomes a link). The default limit goes from 5 to 10 MB and the superadmin can override it per blog from /admin/. Files stay in Postgres so one pg_dump is still the whole blog. The bytea column is STORAGE EXTERNAL and /media streams it in substring() slices, so serving never holds a whole file in memory whatever limit a blog gets. Serving any type on the root domain, which carries the session cookie, needs a policy: uploads are typed by sniffing (the extension may only refine a generic sniff to an allowlisted type) and only images, PDF, plain text, audio and video render inline; HTML, SVG, XML, scripts, archives and binaries always go out as application/octet-stream with Content-Disposition: attachment. The body cap moves out of requireAuth into guardPOST, which runs after withBlog has resolved the blog and so knows its limit. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Sd8UPWrvyYCLj97JexNw3A --- internal/web/handlers_media.go | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) (limited to 'internal/web/handlers_media.go') diff --git a/internal/web/handlers_media.go b/internal/web/handlers_media.go index 4e237fa..7c4b739 100644 --- a/internal/web/handlers_media.go +++ b/internal/web/handlers_media.go @@ -1,7 +1,6 @@ package web import ( - "bytes" "errors" "io/fs" "net/http" @@ -10,7 +9,9 @@ import ( "github.com/gramanas/blogspace/internal/store" ) -// handleMedia serves an uploaded image. Ids are immutable, so clients may cache forever. +// handleMedia serves an uploaded file. Ids are immutable, so clients may cache +// forever (a renamed file keeps its old download name in caches; acceptable). +// What may render inline is decided by servedAs, see filetype.go. func (s *Server) handleMedia(w http.ResponseWriter, r *http.Request) { id, err := uuid.Parse(r.PathValue("id")) if err != nil { @@ -22,7 +23,7 @@ func (s *Server) handleMedia(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusNotModified) return } - img, err := blogStore(r).ImageData(r.Context(), id) + f, err := blogStore(r).FileMeta(r.Context(), id) if err != nil { if errors.Is(err, store.ErrNotFound) { http.NotFound(w, r) @@ -31,11 +32,13 @@ func (s *Server) handleMedia(w http.ResponseWriter, r *http.Request) { s.serverError(w, err) return } - w.Header().Set("Content-Type", img.ContentType) + ctype, disposition := servedAs(f.ContentType, r.URL.Query().Has("download")) + w.Header().Set("Content-Type", ctype) + w.Header().Set("Content-Disposition", contentDisposition(disposition, f.Filename)) w.Header().Set("Cache-Control", "public, max-age=31536000, immutable") w.Header().Set("ETag", etag) w.Header().Set("X-Content-Type-Options", "nosniff") - http.ServeContent(w, r, img.Filename, img.CreatedAt, bytes.NewReader(img.Data)) + http.ServeContent(w, r, f.Filename, f.CreatedAt, blogStore(r).FileReader(r.Context(), f)) } // handleFavicon answers the browsers that ask for /favicon.ico regardless of -- cgit v1.2.3