diff --git a/services/blogpost/chall/app.py b/services/blogpost/chall/app.py
index 5df147a..bc8ca54 100644
--- a/services/blogpost/chall/app.py
+++ b/services/blogpost/chall/app.py
@@ -207,19 +207,29 @@ def create_post():
 
 @app.route('/uploads/<path:filename>')
 def uploaded_file(filename):
+    if "user_id" not in session:
+        return redirect(url_for("login"))
+    if ".." in filename or filename.startswith("/"):
+        abort(404)
+    db = get_db()
+    cur = db.execute("SELECT id FROM posts WHERE image_filename = ? AND author_id = ?", (filename, session["user_id"]))
+    row = cur.fetchone()
+    if not row:
+        abort(404)
     return send_from_directory(app.config['UPLOAD_FOLDER'], filename)
 
 @app.route("/post/<int:pid>")
 def view_post(pid):
+    if "user_id" not in session:
+        return redirect(url_for("login"))
     db = get_db()
     cur = db.execute(
-        "SELECT p.*, u.username as author FROM posts p LEFT JOIN users u ON p.author_id = u.id WHERE p.id = ?",
-        (pid,)
+        "SELECT p.*, u.username as author FROM posts p LEFT JOIN users u ON p.author_id = u.id WHERE p.id = ? AND p.author_id = ?",
+        (pid, session["user_id"])
     )
     post = cur.fetchone()
     if not post:
         abort(404)
-
     return render_template("view_post.html", post=post)
 
 @app.route("/profile")
diff --git a/services/cdn/dist/cdn.rar b/services/cdn/dist/cdn.rar
deleted file mode 100644
index 749be0a..0000000
Binary files a/services/cdn/dist/cdn.rar and /dev/null differ
diff --git a/services/cdn/dist/cdn.zip b/services/cdn/dist/cdn.zip
new file mode 100644
index 0000000..059c694
Binary files /dev/null and b/services/cdn/dist/cdn.zip differ