Screenshots from implementers

internal/server/images.go

@@ -9,6 +9,7 @@ import (
 	"path/filepath"
 	"strings"
 
+	"g.fc.run/misc/byre/internal/agents"
 	"g.fc.run/misc/byre/internal/api"
 )
 
@@ -37,6 +38,11 @@ func (s *Server) GetTaskImage(w http.ResponseWriter, r *http.Request, taskID str
 		writeError(w, http.StatusInternalServerError, err)
 		return
 	}
+	media, err := filepath.EvalSymlinks(agents.MediaDir(t.WorktreePath))
+	if err != nil && !errors.Is(err, fs.ErrNotExist) {
+		writeError(w, http.StatusInternalServerError, err)
+		return
+	}
 
 	path := params.Path
 	if !filepath.IsAbs(path) {
@@ -52,9 +58,8 @@ func (s *Server) GetTaskImage(w http.ResponseWriter, r *http.Request, taskID str
 		return
 	}
 
-	rel, err := filepath.Rel(root, real)
-	if err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
-		writeError(w, http.StatusForbidden, fmt.Errorf("%s is outside the task's worktree", params.Path))
+	if !within(root, real) && (media == "" || !within(media, real)) {
+		writeError(w, http.StatusForbidden, fmt.Errorf("%s is outside the task's worktree and media folder", params.Path))
 		return
 	}
 
@@ -87,3 +92,8 @@ func (s *Server) GetTaskImage(w http.ResponseWriter, r *http.Request, taskID str
 	w.Header().Set("Cache-Control", "private, no-cache")
 	http.ServeContent(w, r, "", info.ModTime(), f)
 }
+
+func within(root, path string) bool {
+	rel, err := filepath.Rel(root, path)
+	return err == nil && rel != ".." && !strings.HasPrefix(rel, ".."+string(filepath.Separator))
+}