github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-21 18:12:32 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: only allow picking of avatars created by self (#6417)

Browse Source 
* SECURITY: only allow picking of avatars created by self

Also adds origin tracking to all uploads including de-duplicated uploads
This commit is contained in:
Sam
2018-09-20 15:33:10 +10:00
committed by Guo Xiang Tan
parent e0be5145cf
commit df45e82377
10 changed files with 196 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
app/controllers/users_controller.rb
View File

@ -865,16 +865,19 @@ class UsersController < ApplicationController
end
end
user.uploaded_avatar_id = upload_id
upload = Upload.find_by(id: upload_id)
# old safeguard
user.create_user_avatar unless user.user_avatar
guardian.ensure_can_pick_avatar!(user.user_avatar, upload)
if AVATAR_TYPES_WITH_UPLOAD.include?(type)
# make sure the upload exists
unless Upload.where(id: upload_id).exists?
if !upload
return render_json_error I18n.t("avatar.missing")
end
user.create_user_avatar unless user.user_avatar
if type == "gravatar"
user.user_avatar.gravatar_upload_id = upload_id
else
@ -882,6 +885,7 @@ class UsersController < ApplicationController
end
end
user.uploaded_avatar_id = upload_id
user.save!
user.user_avatar.save!