From f956b8b4d2260da9f33da825b1b8158c476dd563 Mon Sep 17 00:00:00 2001
From: Christoph Hagen <github@christophhagen.de>
Date: Sun, 15 Jan 2023 16:45:27 +0100
Subject: [PATCH] Protect thumbnail upload, remove unused function

---
 Sources/App/CapServer.swift | 13 -------------
 Sources/App/routes.swift    |  2 ++
 2 files changed, 2 insertions(+), 13 deletions(-)

diff --git a/Sources/App/CapServer.swift b/Sources/App/CapServer.swift
index 144e223..c02170f 100644
--- a/Sources/App/CapServer.swift
+++ b/Sources/App/CapServer.swift
@@ -246,19 +246,6 @@ final class CapServer: ServerOwner {
     }
     
     // MARK: Counts
-    
-    private func updateCounts() throws {
-        do {
-            caps = try caps.mapValues {
-                var cap = $0
-                cap.count = try count(of: $0.id)
-                return cap
-            }
-        } catch {
-            log("Failed to update counts: \(error)")
-            throw error
-        }
-    }
 
     private func images(in folder: URL) throws -> [URL] {
         try fm.contentsOfDirectory(at: folder, includingPropertiesForKeys: nil)
diff --git a/Sources/App/routes.swift b/Sources/App/routes.swift
index f5c912d..00a52a5 100755
--- a/Sources/App/routes.swift
+++ b/Sources/App/routes.swift
@@ -84,11 +84,13 @@ func routes(_ app: Application) {
         return missingThumbnails.map(String.init).joined(separator: ",")
     }
     
+    // Upload the thumbnail of a cap
     app.postCatching("thumbnails", ":cap") { request in
         guard let cap = request.parameters.get("cap", as: Int.self) else {
             log("Invalid cap parameter for thumbnail upload")
             throw Abort(.badRequest)
         }
+        try authorize(request)
         let data = try request.getBodyData()
         server.saveThumbnail(data, for: cap)
     }