From 572e590062bfe749620ed514b20da9fa6bb41f7e Mon Sep 17 00:00:00 2001
From: MarSeventh <1193267292@qq.com>
Date: Sat, 20 Jul 2024 22:17:38 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E6=94=B9=E6=B7=BB=E5=8A=A0API?=
 =?UTF-8?q?=E8=AE=A4=E8=AF=81=E6=97=B6=E4=B8=8A=E4=BC=A0=E9=A1=B5=E6=97=A0?=
 =?UTF-8?q?=E6=B3=95=E4=B8=8A=E4=BC=A0=E7=9A=84bug?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 README.md           |  2 ++
 functions/upload.js | 15 +++++++++++++--
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 70d64c3d..bfc48afc 100644
--- a/README.md
+++ b/README.md
@@ -52,6 +52,8 @@
 
 环境变量增加`AUTH_CODE`，使用如：https://cloudflare-imgbed.域名?authcode=`AUTH_CODE`
 
+同时，必须增加`DOMAIN`环境变量，否则上传页面也无法正常上传。内容填写上传页面的域名即可（如sanyue.site）
+
 #### 访问域名限制
 
 环境变量增加`ALLOWED_DOMAINS`，多个允许的域名用英文`,`分割，如：域名.xyz,域名.cloudns.be,域名.pp.ua
diff --git a/functions/upload.js b/functions/upload.js
index ae94bc9b..3875b36a 100644
--- a/functions/upload.js
+++ b/functions/upload.js
@@ -22,13 +22,24 @@ function isAuthCodeDefined(authCode) {
     return authCode !== undefined && authCode !== null && authCode.trim() !== '';
 }
 
+function isDomainDefined(domain) {
+    return domain !== undefined && domain !== null && domain.trim() !== '';
+}
+
+function isUploadPageRequest(referer) {
+    if (referer && isDomainDefined(env.DOMAIN)) {
+        let refererUrl = new URL(referer);
+        return refererUrl.hostname === env.DOMAIN;
+    }
+    return false;
+}
 export async function onRequestPost(context) {  // Contents of context object
     const { request, env, params, waitUntil, next, data } = context;
-    // const referer = request.headers.get('Referer');
+    const referer = request.headers.get('Referer');
     // const authCode = new URLSearchParams(new URL(referer).search).get('authcode');
     const authCode = new URL(request.url).searchParams.get('authcode');
     const clonedRequest = request.clone();
-    if (isAuthCodeDefined(env.AUTH_CODE) && !isValidAuthCode(env.AUTH_CODE, authCode)) {
+    if (isUploadPageRequest(referer) || (isAuthCodeDefined(env.AUTH_CODE) && !isValidAuthCode(env.AUTH_CODE, authCode))) {
         return new UnauthorizedException("error");
     }
     await errorHandling(context);