dont leak media paths, fix jsp profile selection and add small hack to accept relative timestamps from transcoding

1 files changed, 6 insertions, 3 deletions

diff --git a/server/src/routes/ui/assets.rs b/server/src/routes/ui/assets.rs
index a925e31..cfaa68e 100644
--- a/server/src/routes/ui/assets.rs
+++ b/server/src/routes/ui/assets.rs
@@ -4,7 +4,7 @@
     Copyright (C) 2025 metamuffin <metamuffin.org>
 */
 use crate::routes::ui::{account::session::Session, error::MyResult, CacheControlFile};
-use anyhow::{anyhow, Context};
+use anyhow::{anyhow, bail, Context};
 use base64::Engine;
 use jellybase::{
     assetfed::AssetInner, cache::async_cache_file, database::Database, federation::Federation, CONF,
@@ -56,7 +56,7 @@ pub async fn resolve_asset(asset: AssetInner) -> anyhow::Result<PathBuf> {
         AssetInner::Cache(c) => Ok(c.abs()),
         AssetInner::Assets(c) => Ok(CONF.asset_path.join(c)),
         AssetInner::Media(c) => Ok(CONF.media_path.join(c)),
-        _ => unreachable!(),
+        _ => bail!("wrong asset type"),
     }
 }
 
@@ -168,7 +168,10 @@ pub async fn r_node_thumbnail(
     let t = (t / step).floor() * step;
 
     let asset = match thumb_track_source {
-        TrackSource::Local(LocalTrack { path, .. }) => {
+        TrackSource::Local(a) => {
+            let AssetInner::LocalTrack(LocalTrack { path, .. }) = AssetInner::deser(&a.0)? else {
+                return Err(anyhow!("track set to wrong asset type").into());
+            };
             // the track selected might be different from thumb_track
             jellytranscoder::thumbnail::create_thumbnail(&CONF.media_path.join(path), t).await?
         }