github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-22 22:43:33 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: Ensure only image uploads can be inlined

Browse Source 
This prevents malicious files (for example special crafted XMLs) to be
used in XSS attacks.
This commit is contained in:
Dan Ungureanu
2019-12-11 15:21:41 +02:00
parent dc6b02f050
commit adfa793731
2 changed files with 15 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
app/controllers/uploads_controller.rb
View File

@ -207,10 +207,10 @@ class UploadsController < ApplicationController
content_type: MiniMime.lookup_by_filename(upload.original_filename)&.content_type
}
if params[:inline]
opts[:disposition] = "inline"
elsif !FileHelper.is_supported_image?(upload.original_filename)
if !FileHelper.is_supported_image?(upload.original_filename)
opts[:disposition] = "attachment"
elsif params[:inline]
opts[:disposition] = "inline"
end
file_path = Discourse.store.path_for(upload)