github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-24 13:51:09 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

FIX: Change secure media to encompass attachments as well (#9271)

Browse Source 
If the “secure media” site setting is enabled then ALL files uploaded to Discourse (images, video, audio, pdf, txt, zip etc. etc.) will follow the secure media rules. The “prevent anons from downloading files” setting will no longer have any bearing on upload security. Basically, the feature will more appropriately be called “secure uploads” instead of “secure media”.

This is being done because there are communities out there that would like all attachments and media to be secure based on category rules but still allow anonymous users to download attachments in public places, which is not possible in the current arrangement.
This commit is contained in:
Martin Brennan
2020-03-26 07:16:02 +10:00
committed by GitHub
parent 4fa580fbd1
commit 097851c135
16 changed files with 106 additions and 127 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
spec/lib/upload_security_spec.rb
View File

@ -5,7 +5,7 @@ require 'rails_helper'
RSpec.describe UploadSecurity do
let(:private_category) { Fabricate(:private_category, group: Fabricate(:group)) }
let(:post_in_secure_context) { Fabricate(:post, topic: Fabricate(:topic, category: private_category)) }
let(:upload) { Fabricate(:upload) }
fab!(:upload) { Fabricate(:upload) }
let(:type) { nil }
let(:opts) { { type: type } }
subject { described_class.new(upload, opts) }
@ -144,9 +144,8 @@ RSpec.describe UploadSecurity do
end
end
context "when prevent_anons_from_downloading_files enabled for attachment" do
context "for attachments" do
before do
SiteSetting.prevent_anons_from_downloading_files = true
upload.update(original_filename: 'test.pdf')
end
@ -169,9 +168,8 @@ RSpec.describe UploadSecurity do
expect(subject.should_be_secure?).to eq(false)
end
context "when prevent_anons_from_downloading_files enabled for attachment" do
context "for attachments" do
before do
SiteSetting.prevent_anons_from_downloading_files = true
upload.update(original_filename: 'test.pdf')
end
it "returns false" do