allow external origin to access media files

pages/media.go

@@ -35,6 +35,9 @@ func HandleUserAvatar(w http.ResponseWriter, r *http.Request) error {
 
 func handleMedia(w http.ResponseWriter, r *http.Request, url string) error {
 	utils.SetHeaders(w)
+	if !utils.Config.RestrictiveCORS {
+		w.Header().Set("Access-Control-Allow-Origin", "*")
+	}
 	path := r.URL.Path
 
 	if utils.Config.ForceWebp &&

utils/config.go

@@ -12,6 +12,7 @@ type config struct {
 	ProtocolDetection bool
 	Secure            bool
 	ForceWebp         bool
+	RestrictiveCORS   bool
 	ImageCache        bool
 	CleanupInterval   time.Duration
 	CacheDir          string
@@ -39,6 +40,7 @@ func LoadConfig() {
 		ProtocolDetection: envBool("PROTOCOL_DETECTION"),
 		Secure:            envBool("SECURE"),
 		ForceWebp:         envBool("FORCE_WEBP"),
+		RestrictiveCORS:   envBool("RESTRICTIVE_CORS"),
 		Privacy: map[string]interface{}{
 			"set":           os.Getenv("PRIVACY_NOT_COLLECTED") != "",
 			"policy":        os.Getenv("PRIVACY_POLICY"),