github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-21 18:12:32 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: only allow picking of avatars created by self (#6417)

Browse Source 
* SECURITY: only allow picking of avatars created by self

Also adds origin tracking to all uploads including de-duplicated uploads
This commit is contained in:
Sam
2018-09-20 15:33:10 +10:00
committed by Guo Xiang Tan
parent e0be5145cf
commit df45e82377
10 changed files with 196 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
lib/upload_creator.rb
View File

@ -74,7 +74,10 @@ class UploadCreator
end
# return the previous upload if any
return @upload unless @upload.nil?
if @upload
UserUpload.find_or_create_by!(user_id: user_id, upload_id: @upload.id) if user_id
return @upload
end
fixed_original_filename = nil
if is_image
@ -132,6 +135,10 @@ class UploadCreator
Jobs.enqueue(:create_avatar_thumbnails, upload_id: @upload.id, user_id: user_id)
end
if @upload.errors.empty?
UserUpload.find_or_create_by!(user_id: user_id, upload_id: @upload.id) if user_id
end
@upload
end
ensure