From a8bf1d826e379dec03d25840c7c49c1f30168380 Mon Sep 17 00:00:00 2001
From: Chocobozzz <me@florianbigard.com>
Date: Tue, 24 Jul 2018 18:02:23 +0200
Subject: [PATCH] 404 on unknown thumbnail

---
 server/controllers/static.ts |  4 ++--
 support/nginx/peertube       | 15 ++++++++-------
 2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/server/controllers/static.ts b/server/controllers/static.ts
index f10427f3e..3ccf624a7 100644
--- a/server/controllers/static.ts
+++ b/server/controllers/static.ts
@@ -48,13 +48,13 @@ staticRouter.use(
 const thumbnailsPhysicalPath = CONFIG.STORAGE.THUMBNAILS_DIR
 staticRouter.use(
   STATIC_PATHS.THUMBNAILS,
-  express.static(thumbnailsPhysicalPath, { maxAge: STATIC_MAX_AGE })
+  express.static(thumbnailsPhysicalPath, { maxAge: STATIC_MAX_AGE, fallthrough: false }) // 404 if the file does not exist
 )
 
 const avatarsPhysicalPath = CONFIG.STORAGE.AVATARS_DIR
 staticRouter.use(
   STATIC_PATHS.AVATARS,
-  express.static(avatarsPhysicalPath, { maxAge: STATIC_MAX_AGE })
+  express.static(avatarsPhysicalPath, { maxAge: STATIC_MAX_AGE, fallthrough: false }) // 404 if the file does not exist
 )
 
 // We don't have video previews, fetch them from the origin instance
diff --git a/support/nginx/peertube b/support/nginx/peertube
index 201d95ea2..01506c7aa 100644
--- a/support/nginx/peertube
+++ b/support/nginx/peertube
@@ -53,7 +53,7 @@ server {
     alias /var/www/peertube/peertube-latest/client/dist/$1;
   }
 
-  location ~ ^/static/(thumbnails|avatars)/(.*)$ {
+  location ~ ^/static/(thumbnails|avatars)/ {
     if ($request_method = 'OPTIONS') {
       add_header 'Access-Control-Allow-Origin' '*';
       add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS';
@@ -64,16 +64,17 @@ server {
       return 204;
     }
 
-    if ($request_method = 'GET') {
-      add_header 'Access-Control-Allow-Origin' '*';
-      add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS';
-      add_header 'Access-Control-Allow-Headers' 'Range,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
-    }
+    add_header 'Access-Control-Allow-Origin' '*';
+    add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS';
+    add_header 'Access-Control-Allow-Headers' 'Range,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
 
     # Cache 2 hours
     add_header Cache-Control "public, max-age=7200";
 
-    alias /var/www/peertube/storage/$1/$2;
+    root /var/www/peertube/storage;
+
+    rewrite ^/static/(thumbnails|avatars)/(.*)$ /$1/$2 break;
+    try_files $uri /;
   }
 
   location / {
-- 
2.25.1