O96u
438c1d5529
Add storage_use_date_path for flat vs date-key storage layout and emit basename-only public URLs when hide-folder is enabled. Block image paths on the site host when domain separation is active so only the image host serves files. Update settings UI, i18n, tests, and deployment docs.
16 lines
572 B
TypeScript
16 lines
572 B
TypeScript
import { describe, expect, it } from 'vitest'
|
|
import { validateImageKey } from './image-key'
|
|
|
|
describe('image index key validation', () => {
|
|
it('accepts standard image keys used in index', () => {
|
|
expect(validateImageKey('images/2026/03/abc.webp')).toBe(true)
|
|
expect(validateImageKey('twikoo/2026/03/abc.webp')).toBe(true)
|
|
expect(validateImageKey('images/abc.webp')).toBe(true)
|
|
})
|
|
|
|
it('rejects path traversal keys', () => {
|
|
expect(validateImageKey('../secret')).toBe(false)
|
|
expect(validateImageKey('images/../../etc/passwd')).toBe(false)
|
|
})
|
|
})
|