fix: disallow forward slash in shared link slug

open-api/immich-openapi-specs.json

@@ -23019,6 +23019,7 @@
           "slug": {
             "description": "Custom URL slug",
             "nullable": true,
+            "pattern": "^[^\\/]*$",
             "type": "string"
           },
           "type": {
@@ -23065,6 +23066,7 @@
           "slug": {
             "description": "Custom URL slug",
             "nullable": true,
+            "pattern": "^[^\\/]*$",
             "type": "string"
           }
         },
@@ -23145,6 +23147,7 @@
           "slug": {
             "description": "Custom URL slug",
             "nullable": true,
+            "pattern": "^[^\\/]*$",
             "type": "string"
           },
           "type": {

server/src/dtos/shared-link.dto.ts

@@ -18,6 +18,12 @@ const SharedLinkSearchSchema = z
   })
   .meta({ id: 'SharedLinkSearchDto' });
 
+const SharedLinkSlugSchema = z
+  .string()
+  .regex(/^[^\/]*$/, 'forward slash "/" is not allowed')
+  .nullable()
+  .describe('Custom URL slug');
+
 const SharedLinkCreateSchema = z
   .object({
     type: SharedLinkTypeSchema,
@@ -25,7 +31,7 @@ const SharedLinkCreateSchema = z
     albumId: z.uuidv4().optional().describe('Album ID (for album sharing)'),
     description: z.string().nullable().optional().describe('Link description'),
     password: z.string().nullable().optional().describe('Link password'),
-    slug: z.string().nullable().optional().describe('Custom URL slug'),
+    slug: SharedLinkSlugSchema.optional(),
     expiresAt: isoDatetimeToDate.nullable().describe('Expiration date').default(null).optional(),
     allowUpload: z.boolean().optional().describe('Allow uploads'),
     allowDownload: z.boolean().default(true).optional().describe('Allow downloads'),
@@ -37,7 +43,7 @@ const SharedLinkEditSchema = z
   .object({
     description: z.string().nullable().optional().describe('Link description'),
     password: z.string().nullable().optional().describe('Link password'),
-    slug: z.string().nullable().optional().describe('Custom URL slug'),
+    slug: SharedLinkSlugSchema.optional(),
     expiresAt: isoDatetimeToDate.nullish().describe('Expiration date'),
     allowUpload: z.boolean().optional().describe('Allow uploads'),
     allowDownload: z.boolean().optional().describe('Allow downloads'),
@@ -66,7 +72,7 @@ const SharedLinkResponseSchema = z
     allowUpload: z.boolean().describe('Allow uploads'),
     allowDownload: z.boolean().describe('Allow downloads'),
     showMetadata: z.boolean().describe('Show metadata'),
-    slug: z.string().nullable().describe('Custom URL slug'),
+    slug: SharedLinkSlugSchema,
   })
   .describe('Shared link response')
   .meta({ id: 'SharedLinkResponseDto' });

web/src/lib/components/SharedLinkFormFields.svelte

@@ -32,8 +32,8 @@
 
 <div class="mt-4 flex flex-col gap-4">
   <div>
-    <Field label={$t('custom_url')} description={$t('shared_link_custom_url_description')}>
-      <Input bind:value={slug} autocomplete="off" />
+    <Field label={$t('custom_url')} description={$t('shared_link_custom_url_description')} invalid={slug.includes('/')}>
+      <Input bind:value={slug} pattern="[^\/]*" autocomplete="off" />
     </Field>
     {#if slug}
       <Text size="tiny" color="muted" class="pt-2 break-all">/s/{encodeURIComponent(slug)}</Text>

web/src/lib/managers/language-manager.svelte.ts

@@ -3,7 +3,7 @@ import { lang } from '$lib/stores/preferences.store';
 import { langs } from '$lib/utils/i18n';
 
 class LanguageManager {
-  init() {
+  constructor() {
     eventManager.on({
       AppInit: () => lang.subscribe((lang) => this.setLanguage(lang)),
     });

web/src/routes/+layout.ts

@@ -1,6 +1,5 @@
 import { commandPaletteManager } from '@immich/ui';
 import { goto } from '$app/navigation';
-import { languageManager } from '$lib/managers/language-manager.svelte';
 import { serverConfigManager } from '$lib/managers/server-config-manager.svelte';
 import { maintenanceCreateUrl, maintenanceReturnUrl, maintenanceShouldRedirect } from '$lib/utils/maintenance';
 import { init } from '$lib/utils/server';
@@ -24,7 +23,6 @@ export const load = (async ({ fetch, url }) => {
   }
 
   commandPaletteManager.enable();
-  languageManager.init();
 
   return {
     error,