Blocked origins

VoidCat/Controllers/DownloadController.cs

@@ -111,6 +111,16 @@ public class DownloadController : Controller
 
     private async Task<VoidFileResponse?> SetupDownload(Guid id)
     {
+        var origin = Request.Headers.Origin.FirstOrDefault();
+        if (!string.IsNullOrEmpty(origin) && Uri.TryCreate(origin, UriKind.RelativeOrAbsolute, out var u))
+        {
+            if (_settings.BlockedOrigins.Any(a => string.Equals(a, u.DnsSafeHost, StringComparison.InvariantCultureIgnoreCase)))
+            {
+                Response.StatusCode = (int)HttpStatusCode.Forbidden;
+                return default;
+            }
+        }
+
         var meta = await _fileInfo.Get(id, false);
         if (meta == null)
         {
@@ -181,7 +191,8 @@ public class DownloadController : Controller
             if (order?.Status == PaywallOrderStatus.Paid)
             {
                 return true;
-            } 
+            }
+
             if (order?.Status is PaywallOrderStatus.Unpaid)
             {
                 // check status
@@ -191,10 +202,11 @@ public class DownloadController : Controller
                 {
                     await _paymentOrders.UpdateStatus(order.Id, status.Status);
                 }
+
                 if (status?.Status == PaywallOrderStatus.Paid)
                 {
                     return true;
-                } 
+                }
             }
         }
 

VoidCat/Model/VoidSettings.cs

@@ -11,7 +11,7 @@ namespace VoidCat.Model
         /// Maintenance flag
         /// </summary>
         public bool MaintenanceMode { get; init; } = false;
-        
+
         /// <summary>
         /// Base site url, used for redirect urls
         /// </summary>
@@ -127,11 +127,16 @@ namespace VoidCat.Model
             "udp://tracker.openbittorrent.com:6969/announce",
             "http://tracker.openbittorrent.com:80/announce"
         };
-        
+
         /// <summary>
         /// Lightning node configuration for LNProxy services
         /// </summary>
         public LndConfig? LndConfig { get; init; }
+
+        /// <summary>
+        /// Blocked origin hostnames
+        /// </summary>
+        public List<string> BlockedOrigins { get; init; } = new();
     }
 
     public sealed class TorSettings