Allow blacklisting domains

README.md

@@ -26,6 +26,8 @@ cd banquo-server && npm install
 
 To only allow traffic from whitelisted domains, enter the full path of the sites you are expecting to use this service in `config.json`. Whitelisting is disabled by default because it is difficult to test locally since you won't always get a value for `req.headers.referer`. Best to only enable this when you move to production.
 
+It is also possible to blacklist certain domains by providing a list of such domains in `config.json` file.
+
 You also have the option of uploading a `png` to S3 in addition to returning it as a base64 encoded string. To do this, fill out the fields in the config file.
 
 

app.js

@@ -94,7 +94,9 @@ function uploadToS3(image_data, timestamp){
 
 app.enable("jsonp callback");
 app.get("/:url/:opts?*", function(req, res) {
-	if (config.disable_whitelist || config.referer_whitelist.indexOf(String(req.headers.referer)) != -1){
+	var referer = String(req.headers.referer);
+	if ((config.disable_whitelist || config.referer_whitelist.indexOf(referer) != -1) &&
+	    (config.disable_blacklist || config.referer_blacklist.indexOf(referer) == -1)){
 		var result = assembleSettings(req.params.url, req.params.opts);
 		if (result.status){
 			banquo.capture(result.settings, function(image_data){
@@ -108,7 +110,7 @@ app.get("/:url/:opts?*", function(req, res) {
 			errorResponse(res, 'opts', result.error);
 		}
 	}else{
-		errorResponse(res, 'incorrect referer, please look at your whitelist. Incoming refer is', String(req.headers.referer) );
+		errorResponse(res, 'incorrect referer, please look at your whitelist and/or blacklist. Incoming refer is', referer );
 	}
 
 });

config.json

@@ -1,6 +1,8 @@
 {
   "disable_whitelist": true,
   "referer_whitelist": ["http://domain.com/path/to/index.html", "localhost", "0.0.0.0"],
+  "disable_blacklist": true,
+  "referer_blacklist": ["http://example.com"],
   "upload_to_s3": false,
   "credentials": "path/to/s3_keys.json",
   "bucket": "bucket-name",