zib/Veskslop-t
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refuse non-media streams and gate video framing

Browse Source
This commit is contained in:
Fisto
2026-09-16 14:04:57 +02:00
parent c100bc269c
commit d522681553
5 changed files with 28 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/media.md
+3 -1
View File
@@ -158,7 +158,9 @@ that deletion is irreversible. The delete button is disabled for a 5 second coun
` /api/media/<scrape>/<item>/stream`, which serves the local file or re-fetches the source message
for a fresh signed URL, so expired CDN links still play. The grid prefers the cached still; a
video without one gets its first frame through the same-origin stream endpoint, which avoids
cross-origin blocking and URL expiry. Embed `videoUrl`s (gifv/Tenor mp4s) are stored as
cross-origin blocking and URL expiry. Only real video-file URLs are framed; provider pages
(YouTube embeds, redirector URLs) are never, and the stream route answers `415` when the
upstream is not media — so a pending preview shows a placeholder instead of a browser error. Embed `videoUrl`s (gifv/Tenor mp4s) are stored as
`play_url` and used through the stream. The full link is a separate button that opens the
original page with the warning. Length comes from Discord's attachment duration and, for
downloads, an ffprobe probe. GIF tiles carry a translucent **GIF** label top-left; the cached
docs/webui.md
+1 -1
View File
@@ -261,7 +261,7 @@ replaceable.
| GET | `/api/media` | `kind?`, `source?`, `channelId?`, `authorId?`, `aspect?`, `resolution?`, `after?`, `before?`, `limit?`, `offset?` | Media items across every scrape, newest first. `source` is `attachment`, `sticker`, or `embed`; `aspect` and `resolution` are the preset keys; `after`/`before` are ISO times on `posted_at`. Items carry `authorName`, `postedAt`, `width`, `height`, `aspectRatio`, `contentType`, `durationSecs`; `localUrl`/`thumbUrl` when a file or preview exists |
| GET | `/api/media/:scrapeId/:itemId/file` | none | The downloaded file, content-typed from its extension |
| GET | `/api/media/:scrapeId/:itemId/thumb` | none | The cached preview (type from `preview_ext`) |
| GET | `/api/media/:scrapeId/:itemId/stream` | none | Playback/full-view source: the local file, or the remote URL refreshed from the source message. Supports `Range` |
| GET | `/api/media/:scrapeId/:itemId/stream` | none | Playback/full-view source: the local file, or the remote URL refreshed from the source message. Supports `Range`. Non-media upstream responses (provider pages) return `415` |
| GET | `/api/media/scrapes` | none | Every scrape with state and counters |
| GET | `/api/media/status` | none | Slopbot connection state and the scrape list |
| GET | `/api/media/authors` | none | Distinct posters across every scrape, with counts |