@@ -25,6 +25,7 @@ if __name__ == '__main__':
2525import json
2626import cStringIO
2727import os
28+import hashlib
2829
2930from datetime import datetime, timedelta
3031from requests import get as http_get
@@ -41,7 +42,7 @@ from searx.engines import (
4142)
4243from searx.utils import (
4344 UnicodeWriter, highlight_content, html_to_text, get_themes,
44− get_static_files, get_result_templates, gen_useragent
45+ get_static_files, get_result_templates, gen_useragent, dict_subset
4546)
4647from searx.version import VERSION_STRING
4748from searx.languages import language_codes
@@ -213,11 +214,13 @@ def image_proxify(url):
213214 if url.startswith('//'):
214215 url = 'https:' + url
215216
217+ h = hashlib.sha256(url + settings['server']['secret_key']).hexdigest()
218+
216219 if not settings['server'].get('image_proxy') and not request.cookies.get('image_proxy'):
217220 return url
218221
219222 return '{0}?{1}'.format(url_for('image_proxy'),
220− urlencode(dict(url=url)))
223+ urlencode(dict(url=url, h=h)))
221224
222225
223226def render(template_name, override_theme=None, **kwargs):
@@ -562,10 +565,21 @@ def image_proxy():
562565 if not url:
563566 return '', 400
564567
568+ h = hashlib.sha256(url + settings['server']['secret_key']).hexdigest()
569+
570+ if h != request.args.get('h'):
571+ return '', 400
572+
573+ headers = dict_subset(request.headers, {'If-Modified-Since', 'If-None-Match'})
574+ headers['User-Agent'] = gen_useragent()
575+
565576 resp = http_get(url,
566577 stream=True,
567578 timeout=settings['server'].get('request_timeout', 2),
568− headers={'User-Agent': gen_useragent()})
579+ headers=headers)
580+
581+ if resp.status_code == 304:
582+ return '', resp.status_code
569583
570584 if resp.status_code != 200:
571585 logger.debug('image-proxy: wrong response code: {0}'.format(resp.status_code))
@@ -586,7 +600,9 @@ def image_proxy():
586600 return '', 502 # Bad gateway - file is too big (>5M)
587601 img += chunk
588602
589− return Response(img, mimetype=resp.headers['content-type'])
603+ headers = dict_subset(resp.headers, {'Content-Length', 'Length', 'Date', 'Last-Modified', 'Expires', 'Etag'})
604+
605+ return Response(img, mimetype=resp.headers['content-type'], headers=headers)
590606
591607
592608@app.route('/stats', methods=['GET'])