github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-25 00:32:52 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: Add rate limits for uploads

Browse Source
This commit is contained in:
Alan Guo Xiang Tan
2024-02-07 12:55:36 +08:00
committed by Nat
parent 819361ba28
commit 003b80e62f
3 changed files with 36 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
app/controllers/uploads_controller.rb
View File

@ -25,6 +25,13 @@ class UploadsController < ApplicationController
# capture current user for block later on
me = current_user
RateLimiter.new(
current_user,
"uploads-per-minute",
SiteSetting.max_uploads_per_minute,
1.minute.to_i,
).performed!
params.permit(:type, :upload_type)
raise Discourse::InvalidParameters if params[:type].blank? && params[:upload_type].blank?
# 50 characters ought to be enough for the upload type