Merge 397a3bddd6 into 354278d488

server_test.go

@@ -126,8 +126,8 @@ func TestPostCodeUpload(t *testing.T) {
 
 	mux.ServeHTTP(w, req)
 
-	if w.Code != 301 {
-		t.Fatalf("Status code is not 301, but %d", w.Code)
+	if w.Code != 303 {
+		t.Fatalf("Status code is not 303, but %d", w.Code)
 	}
 
 	if w.Header().Get("Location") != "/"+filename+"."+extension {
@@ -157,8 +157,8 @@ func TestPostCodeUploadWhitelistedHeader(t *testing.T) {
 
 	mux.ServeHTTP(w, req)
 
-	if w.Code != 301 {
-		t.Fatalf("Status code is not 301, but %d", w.Code)
+	if w.Code != 303 {
+		t.Fatalf("Status code is not 303, but %d", w.Code)
 	}
 }
 
@@ -287,8 +287,8 @@ func TestPostUpload(t *testing.T) {
 
 	mux.ServeHTTP(w, req)
 
-	if w.Code != 301 {
-		t.Fatalf("Status code is not 301, but %d", w.Code)
+	if w.Code != 303 {
+		t.Fatalf("Status code is not 303, but %d", w.Code)
 	}
 
 	if w.Header().Get("Location") != "/"+filename {

upload.go

@@ -103,7 +103,7 @@ func uploadPostHandler(c web.C, w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
-		http.Redirect(w, r, "/"+upload.Filename, 301)
+		http.Redirect(w, r, "/"+upload.Filename, 303)
 	}
 
 }
@@ -138,8 +138,13 @@ func uploadPutHandler(c web.C, w http.ResponseWriter, r *http.Request) {
 }
 
 func uploadRemote(c web.C, w http.ResponseWriter, r *http.Request) {
+	if !strictReferrerCheck(r, Config.siteURL, []string{"Linx-Delete-Key", "Linx-Expiry", "Linx-Randomize"}) {
+		badRequestHandler(c, w, r)
+		return
+	}
+
 	if r.FormValue("url") == "" {
-		http.Redirect(w, r, "/", 301)
+		http.Redirect(w, r, "/", 303)
 		return
 	}
 
@@ -174,7 +179,7 @@ func uploadRemote(c web.C, w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
-		http.Redirect(w, r, "/"+upload.Filename, 301)
+		http.Redirect(w, r, "/"+upload.Filename, 303)
 	}
 }