github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-22 04:41:25 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

FIX: Use presigned URL to avoid 403 when pulling hotlinked images for secure media (#8764)

Browse Source 
When we were pulling hotlinked images for oneboxes in the CookedPostProcessor, we were using the direct S3 URL, which returned a 403 error and thus did not set widths and heights of the images. We now cook the URL first based on whether the upload is secure before handing off to FastImage.
This commit is contained in:
Martin Brennan
2020-01-23 09:31:46 +10:00
committed by GitHub
parent 57390d0bb9
commit 4646a38ae6
2 changed files with 60 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
lib/cooked_post_processor.rb
View File

@ -277,14 +277,18 @@ class CookedPostProcessor
absolute_url = url
absolute_url = Discourse.base_url_no_prefix + absolute_url if absolute_url =~ /^\/[^\/]/
if url&.start_with?("/secure-media-uploads/")
absolute_url = Discourse.store.signed_url_for_path(url.sub("/secure-media-uploads/", ""))
end
return unless absolute_url
# FastImage fails when there's no scheme
absolute_url = SiteSetting.scheme + ":" + absolute_url if absolute_url.start_with?("//")
# we can't direct FastImage to our secure-media-uploads url because it bounces
# anonymous requests with a 404 error
if url&.include?("/secure-media-uploads/")
secure_upload_s3_path = absolute_url.sub(Discourse.base_url, "").sub("/secure-media-uploads/", "")
absolute_url = Discourse.store.signed_url_for_path(secure_upload_s3_path)
end
return unless is_valid_image_url?(absolute_url)
# we can *always* crawl our own images
@ -539,7 +543,10 @@ class CookedPostProcessor
upload_id = downloaded_images[src]
upload = Upload.find_by_id(upload_id) if upload_id
img["src"] = upload.url if upload.present?
if upload.present?
img["src"] = UrlHelper.cook_url(upload.url, secure: @post.with_secure_media?)
end
# make sure we grab dimensions for oneboxed images
# and wrap in a div