From a04f7bd650c55d9f6e82f8df93f6fc590db326c7 Mon Sep 17 00:00:00 2001
From: NGPixel <github@ngpixel.com>
Date: Sat, 22 Jan 2022 19:52:59 -0500
Subject: [PATCH] fix: force uploads to use auth headers instead of cookie

---
 client/components/editor/editor-modal-media.vue | 14 +++++++++++++-
 server/helpers/security.js                      |  4 ++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/client/components/editor/editor-modal-media.vue b/client/components/editor/editor-modal-media.vue
index 47fa878a1f..100a36df8e 100644
--- a/client/components/editor/editor-modal-media.vue
+++ b/client/components/editor/editor-modal-media.vue
@@ -143,7 +143,7 @@
                 allow-multiple='true'
                 :files='files'
                 max-files='10'
-                server='/u'
+                :server='filePondServerOpts'
                 :instant-upload='false'
                 :allow-revert='false'
                 @processfile='onFileProcessed'
@@ -230,6 +230,7 @@
 <script>
 import _ from 'lodash'
 import { get, sync } from 'vuex-pathify'
+import Cookies from 'js-cookie'
 import vueFilePond from 'vue-filepond'
 import 'filepond/dist/filepond.min.css'
 
@@ -312,6 +313,17 @@ export default {
     },
     currentAsset () {
       return _.find(this.assets, ['id', this.currentFileId]) || {}
+    },
+    filePondServerOpts () {
+      const jwtToken = Cookies.get('jwt')
+      return {
+        process: {
+          url: '/u',
+          headers: {
+            'Authorization': `Bearer ${jwtToken}`
+          }
+        }
+      }
     }
   },
   watch: {
diff --git a/server/helpers/security.js b/server/helpers/security.js
index 4f0ef46fdc..c138ada176 100644
--- a/server/helpers/security.js
+++ b/server/helpers/security.js
@@ -31,6 +31,10 @@ module.exports = {
       if (req && req.cookies) {
         token = req.cookies['jwt']
       }
+      // Force uploads to use Auth headers
+      if (req.path === '/u') {
+        return null
+      }
       return token
     }
   ])