Discourse/discourse
Discourse/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-09-05 08:59:27 +08:00
Code Packages Activity Actions 11

SECURITY: Ensure only image uploads can be inlined

Browse source 
This prevents malicious files (for example special crafted XMLs) to be
used in XSS attacks.
This commit is contained in:
Dan Ungureanu 2019-12-11 15:21:41 +02:00
parent dc6b02f050
commit adfa793731
No known key found for this signature in database
GPG key ID: 0AA2A00D6ACC8B84
2 changed files with 15 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
app/controllers/uploads_controller.rb
View file

@ -207,10 +207,10 @@ class UploadsController < ApplicationController
content_type: MiniMime.lookup_by_filename(upload.original_filename)&.content_type
}
if params[:inline]
opts[:disposition] = "inline"
elsif !FileHelper.is_supported_image?(upload.original_filename)
if !FileHelper.is_supported_image?(upload.original_filename)
opts[:disposition] = "attachment"
elsif params[:inline]
opts[:disposition] = "inline"
end
file_path = Discourse.store.path_for(upload)