From 4b2b4af606237def78273a42e881ae9f971cb505 Mon Sep 17 00:00:00 2001
From: salmonik <salmonik@tuta.io>
Date: Wed, 4 Nov 2026 01:29:57 +0100
Subject: net: block private and link-local URLs

---
 src/commands/cron.rs | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'src/commands/cron.rs')

diff --git a/src/commands/cron.rs b/src/commands/cron.rs
index ebaa96d..301ae3d 100644
--- a/src/commands/cron.rs
+++ b/src/commands/cron.rs
@@ -45,6 +45,9 @@ pub async fn dodaj_audio(
     };
 
     let guild_id = ctx.guild_id().ok_or_else(lang::err_not_in_guild)?;
+    if !ctx.data().copyparty.is_own_url(&full_url) {
+        crate::net::ensure_public_http_url(&full_url).await?;
+    }
     database::add_cron_job(
         &ctx.data().db_pool,
         guild_id.get() as i64,
-- 
cgit v1.2.3