github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-06-04 06:44:43 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

FIX: ensure extra locales are only available to staff

Browse Source
This commit is contained in:
Régis Hanol
2019-08-20 12:38:46 +02:00
parent d18c9b2d4d
commit 53667a01c2
2 changed files with 53 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
app/controllers/extra_locales_controller.rb
View File

@ -1,7 +1,6 @@
# frozen_string_literal: true
class ExtraLocalesController < ApplicationController
layout :false
skip_before_action :check_xhr,
@ -11,13 +10,14 @@ class ExtraLocalesController < ApplicationController
def show
bundle = params[:bundle]
raise Discourse::InvalidAccess.new unless bundle =~ /^(admin|wizard)$/
if params[:v] && params[:v].length == 32
raise Discourse::InvalidAccess.new if bundle !~ /^(admin|wizard)$/ || !current_user&.staff?
if params[:v]&.size == 32
hash = ExtraLocalesController.bundle_js_hash(bundle)
if hash == params[:v]
immutable_for 24.hours
end
immutable_for(24.hours) if hash == params[:v]
end
render plain: ExtraLocalesController.bundle_js(bundle), content_type: "application/javascript"
end