Imageblob only from allowed origin

server/public/assets/js/frontpage.js

@@ -221,6 +221,9 @@ var Frontpage = {
                             $("#mega-background").css("opacity", 1);
                             $(".autocomplete").attr("placeholder", list[i]._id);
                         },500);
+                    },
+                    error: function() {
+                        $(".autocomplete").attr("placeholder", list[i]._id);
                     }
                 });
             };

server/routing/client/api.js

@@ -1095,10 +1095,16 @@ function incrementToken(token) {
 
 router.route('/api/imageblob').post(function(req, res) {
     var Jimp = require("jimp");
+    var origin = req.get("origin").replace("https://", "").replace("http://", "");
+    var allowed = ["client.localhost", "localhost", "zoff.me", "client.zoff.me", "zoff.no", "client.zoff.no"];
+    if(allowed.indexOf(origin) < 0) {
+        res.sendStatus(403);
+        return;
+    }
     Jimp.read('https://img.youtube.com/vi/' + req.body.id + '/mqdefault.jpg', function (err, image) {
         if (err) {
             console.log(err);
-            res.send(404);
+            res.sendStatus(404);
             return;
         }
         image.blur(50)