Added WHITELIST_BASE_DOMAIN

docs/DOCKER-FULL.md

@@ -48,6 +48,11 @@ services:
       # Disable POW Captcha
       PUBLIC_CAPTCHA_DISABLED: "false"
       
+      # Allows you to whitelist additional domains in proxy.
+      # Should be comma separated and be the base domain
+      # e.g. "youtube.com,google.com" NOT "https://youtube.com,https://videos.google.com"
+      WHITELIST_BASE_DOMAIN: ""
+
       # Allow any domain in proxy
       # This shouldn't be used unless you KNOW what your doing
       # requires VITE_REGISTRATION_ALLOWED to be false

materialious/src/routes/api/proxy/[urlToProxy]/+server.ts

@@ -1,5 +1,6 @@
 import { isOwnBackend } from '$lib/shared';
 import { env } from '$env/dynamic/public';
+import { env as privateEnv } from '$env/dynamic/private';
 
 import { error } from '@sveltejs/kit';
 import { parse as tldParse } from 'tldts';
@@ -14,6 +15,12 @@ const allowedBaseDomains: string[] = [
 	'ajay.app'
 ];
 
+if (privateEnv.WHITELIST_BASE_DOMAIN) {
+	for (const baseDomain of privateEnv.WHITELIST_BASE_DOMAIN.split(',')) {
+		if (baseDomain) allowedBaseDomains.push(baseDomain);
+	}
+}
+
 const dynamicAllowDomainsEnvVars = [
 	env.PUBLIC_DEFAULT_DEARROW_THUMBNAIL_INSTANCE,
 	env.PUBLIC_DEFAULT_DEARROW_INSTANCE,