Discourse/discourse
Discourse/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-09-06 09:10:25 +08:00
Code Packages Activity Actions 11

SECURITY: limit route access when using external avatars

Browse source
This commit is contained in:
Sam 2016-07-28 08:59:58 +10:00
parent 437ad5b05a
commit cb3afd11b4
2 changed files with 17 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
app/controllers/user_avatars_controller.rb
View file

@ -21,8 +21,11 @@ class UserAvatarsController < ApplicationController
end
end
# mainly used in development for backwards compat
def show_proxy_letter
if SiteSetting.external_system_avatars_url !~ /^\/letter_avatar_proxy/
raise Discourse::NotFound
end
params.require(:letter)
params.require(:color)
params.require(:version)