Only allow requests from hosts we allow

config.sample.yaml

 # The configuration for the homeservers this media repository is known to control. Servers
 # not listed here will not be able to upload media.
-# NOT YET IMPLEMENTED
 homeservers:
   - name: t2bot.io
     downloadRequiresAuth: false

src/github.com/turt2live/matrix-media-repo/client/r0/download.go

@@ -60,10 +60,6 @@ func DownloadMedia(w http.ResponseWriter, r *http.Request, db storage.Database,
 }
 
 func ValidateUserCanDownload(r *http.Request, db storage.Database, c config.MediaRepoConfig) (bool) {
-	if !util.IsServerOurs(r.Host, c) {
-		return true // TODO: Restrict remote media too?
-	}
-
 	hs := util.GetHomeserverConfig(r.Host, c)
 	if !hs.DownloadRequiresAuth {
 		return true // no auth required == can access

src/github.com/turt2live/matrix-media-repo/client/r0/upload.go

@@ -24,9 +24,6 @@ type MediaUploadedResponse struct {
 }
 
 func UploadMedia(w http.ResponseWriter, r *http.Request, db storage.Database, c config.MediaRepoConfig) interface{} {
-	if !util.IsServerOurs(r.Host, c) {
-		return client.AuthFailed()
-	}
 	accessToken := util.GetAccessTokenFromRequest(r)
 	userId, err := util.GetUserIdFromToken(r.Context(), r.Host, accessToken, c)
 	if err != nil || userId == "" {

src/github.com/turt2live/matrix-media-repo/media_repo.go

@@ -12,6 +12,7 @@ import (
 	"github.com/turt2live/matrix-media-repo/client/r0"
 	"github.com/turt2live/matrix-media-repo/config"
 	"github.com/turt2live/matrix-media-repo/storage"
+	"github.com/turt2live/matrix-media-repo/util"
 )
 
 const UnkErrJson = `{"code":"M_UNKNOWN","message":"Unexpected error processing response"}`
@@ -76,9 +77,12 @@ func (h Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Server", "matrix-media-repo")
 
 	// Process response
-	res := h.h(w, r, h.opts.db, h.opts.config)
-	if res == nil {
-		res = &EmptyResponse{}
+	var res interface{} = client.AuthFailed()
+	if util.IsServerOurs(r.Host, h.opts.config) {
+		res = h.h(w, r, h.opts.db, h.opts.config)
+		if res == nil {
+			res = &EmptyResponse{}
+		}
 	}
 
 	b, err := json.Marshal(res)