feat(mobile): only allow request from mobile client to copy session

middleware/common.go

@@ -3,9 +3,11 @@ package middleware
 import (
 	"fmt"
 	model "github.com/cloudreve/Cloudreve/v3/models"
+	"github.com/cloudreve/Cloudreve/v3/pkg/auth"
 	"github.com/cloudreve/Cloudreve/v3/pkg/hashid"
 	"github.com/cloudreve/Cloudreve/v3/pkg/serializer"
 	"github.com/gin-gonic/gin"
+	"net/http"
 )
 
 // HashID 将给定对象的HashID转换为真实ID
@@ -60,3 +62,16 @@ func StaticResourceCache() gin.HandlerFunc {
 
 	}
 }
+
+// MobileRequestOnly
+func MobileRequestOnly() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if c.GetHeader(auth.CrHeaderPrefix+"ios") == "" {
+			c.Redirect(http.StatusMovedPermanently, model.GetSiteURL().String())
+			c.Abort()
+			return
+		}
+
+		c.Next()
+	}
+}

routers/controllers/user.go

@@ -395,5 +395,4 @@ func UserPerformCopySession(c *gin.Context) {
 	} else {
 		c.JSON(200, ErrorResponse(err))
 	}
-
 }

routers/router.go

@@ -234,7 +234,12 @@ func InitMasterRouter() *gin.Engine {
 				file.GET("archive/:sessionID/archive.zip", controllers.DownloadArchive)
 			}
 
-			sign.GET("user/session/copy/:id", controllers.UserPerformCopySession)
+			// Copy user session
+			sign.GET(
+				"user/session/copy/:id",
+				middleware.MobileRequestOnly(),
+				controllers.UserPerformCopySession,
+			)
 		}
 
 		// 从机的 RPC 通信