github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-21 18:12:32 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: Make sure uploaded_urls have corresponding upload records

Browse Source
This commit is contained in:
Robin Ward
2016-07-28 13:54:17 -04:00
parent cf5b756b1a
commit 2891f230d1
8 changed files with 67 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
lib/validators/upload_url_validator.rb Normal file
View File

@ -0,0 +1,11 @@
class UploadUrlValidator < ActiveModel::EachValidator
def validate_each(record, attribute, value)
if value.present?
uri = URI.parse(value) rescue nil
unless uri && Upload.exists?(url: value)
record.errors[attribute] << (options[:message] || I18n.t('errors.messages.invalid'))
end
end
end
end