diff --git a/pount/apps/iiif/views.py b/pount/apps/iiif/views.py index bc175f7a159baaf2d567f441619402402626fdbb..d9161027a7850fea0d26a8e759161ad6a1ebc098 100644 --- a/pount/apps/iiif/views.py +++ b/pount/apps/iiif/views.py @@ -62,12 +62,14 @@ class IIIFProxyView(ProxyView): self.http = urllib3.PoolManager(maxsize=100) def dispatch(self, request, *args, **kwargs): + file_id = request.path.lstrip("iiif/3").split(".tiled.tif")[0] + file = get_object_or_404(MediaFile, id=file_id) + if file.item.is_public: + return super().dispatch(request, *args, **kwargs) try: response = JWT_authenticator.authenticate(request) if response is not None: user, _ = response - file_id = request.path.lstrip("iiif/3").split(".tiled.tif")[0] - file = get_object_or_404(MediaFile, id=file_id) if user.has_perm(ITEM_VIEW, file.item): return super().dispatch(request, *args, **kwargs) except InvalidToken: