Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-12 05:37:26 +08:00
Code Packages Activity Actions
discourse/app/jobs/regular
History
Exact
Alan Guo Xiang Tan eff53af263 SECURITY: Authorize secure-upload hotlink downloads against post user [backport 2026.1] 
Backport of #705 to release/2026.1.

---

Advisory: https://github.com/discourse/discourse/security/advisories/GHSA-3876-w96v-8v38

When a post embeds an `<img>` pointing at a secure-uploads URL whose upload is owned by an access-controlled post (for example a private category), `Jobs::PullHotlinkedImages` would resolve the presigned S3 URL and attach a fresh local copy of the upload to the embedding post regardless of whether its author could see the original. A user could hotlink the secure-uploads URL of media they should not have access to into a post they authored, and `Jobs::PullHotlinkedImages` would create a fresh local copy attached to their post.

This commit gates `Jobs::PullHotlinkedImages#should_download_image?` on a new `can_see_upload?` helper. For secure uploads the helper checks the post author against the upload's `access_control_post` with `user.guardian.can_see_post?`. When the author cannot see the access-control post, the job leaves the original secure URL in place and does not create a local copy.
2026-06-30 16:27:06 +02:00
..
admin_confirmation_email.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
anonymize_user.rb FIX: Only anonymize staff log fields that contain the username (#37242) 2026-01-27 17:39:21 +01:00
automatic_group_membership.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
backfill_badge.rb PERF: Set cluster_concurrency 1 for Jobs::BackfillBadge (#32121) 2025-04-02 11:23:32 +08:00
backfill_sidebar_site_settings.rb FIX: Set Jobs::BackfillSidebarSiteSettings cluster concurrency to 1 (#22316) 2023-06-28 13:07:46 +08:00
backup_chunks_merger.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
bulk_grant_trust_level.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
bulk_invite.rb DEV: Update bulk-invite logs and PM template (#27057) 2024-05-17 12:21:21 -06:00
bulk_user_title_update.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
bump_topic.rb
change_display_name.rb DEV: Update to lastest rubocop-discourse 2024-05-27 18:06:14 +02:00
check_video_conversion_status.rb DEV: Update mediaconvert to use a subdirectory for output (#36049) 2025-11-20 14:03:14 -07:00
clear_slow_mode.rb
close_topic.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
confirm_sns_subscription.rb SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks [backport 2026.1] 2026-06-30 16:27:06 +02:00
convert_video.rb FEATURE: Add support for aws MediaConvert (#33092) 2025-07-23 11:58:33 -06:00
crawl_topic_link.rb DEV: always load the excon gem 2026-01-15 17:13:11 -05:00
create_avatar_thumbnails.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
create_backup.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
create_linked_topic.rb DEV: Update to lastest rubocop-discourse 2024-05-27 18:06:14 +02:00
create_user_reviewable.rb DEV: Update to lastest rubocop-discourse 2024-05-27 18:06:14 +02:00
critical_user_email.rb DEV: Fix various rubocop lints (#24749) 2023-12-06 23:25:00 +01:00
delete_inaccessible_notifications.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
delete_replies.rb FIX: DeleteReplies should use the guardian instead of checking for staff (#35443) 2025-10-16 18:26:41 +02:00
delete_topic.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
delete_user_posts.rb I18N: Add pluralization for chat rewind, bulk tagging & post deleted msg (#37255) 2026-01-26 14:41:54 +01:00
download_avatar_from_url.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
download_backup_email.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
download_profile_background_from_url.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
emit_web_hook_event.rb DEV: always load the excon gem 2026-01-15 17:13:11 -05:00
enable_bootstrap_mode.rb UX: make first admin a moderator to review user approvals. (#26588) 2024-04-10 20:59:03 +05:30
export_csv_file.rb FIX: align staff action CSV export with log visibility rules [backport 2026.1] (#40194) 2026-05-20 10:50:47 -03:00
export_user_archive.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
feature_topic_users.rb DEV: Update to lastest rubocop-discourse 2024-05-27 18:06:14 +02:00
generate_topic_thumbnails.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
group_pm_alert.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
group_pm_update_summary.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
group_smtp_email.rb DEV: Remove IMAP support in Discourse (#37002) 2026-01-12 10:07:26 +10:00
index_category_for_search.rb
index_user_fields_for_search.rb FIX: Move user reindexing into a job (#26753) 2024-04-25 20:58:34 +08:00
invite_email.rb DEV: Update to lastest rubocop-discourse 2024-05-27 18:06:14 +02:00
invite_password_instructions_email.rb DEV: Update to lastest rubocop-discourse 2024-05-27 18:06:14 +02:00
make_embedded_topic_visible.rb FIX: Better tracking of topic visibility changes (#26709) 2024-04-29 10:34:46 +10:00
mass_award_badge.rb
merge_user.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
notify_category_change.rb FIX: Notify mailing list subscribers on category change (#28811) 2024-10-11 14:47:39 +02:00
notify_mailing_list_subscribers.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
notify_moved_posts.rb DEV: Hand-pick Rails/WhereNot autofixes (#35117) 2025-10-03 13:29:22 +02:00
notify_post_revision.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
notify_reviewable.rb DEV: Hand-pick Rails/WhereNot autofixes (#35117) 2025-10-03 13:29:22 +02:00
notify_tag_change.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
open_topic.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
post_alert.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
post_update_topic_tracking_state.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
process_bulk_invite_emails.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
process_email.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
process_localized_cooked.rb DEV: Add rake task to backfill localization excerpts which were empty (#36901) 2025-12-30 17:04:36 +08:00
process_post.rb FEATURE: Display the Watched Words that caused a post to be flagged. (#31435) 2025-03-04 17:22:12 +11:00
process_sns_notification.rb SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks [backport 2026.1] 2026-06-30 16:27:06 +02:00
publish_group_membership_updates.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
publish_topic_to_category.rb
pull_hotlinked_images.rb SECURITY: Authorize secure-upload hotlink downloads against post user [backport 2026.1] 2026-06-30 16:27:06 +02:00
pull_user_profile_hotlinked_images.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
push_notification.rb DEV: Fix undefined variable (#29876) 2024-11-21 20:23:20 +02:00
rebake_custom_emoji_posts.rb
rebake_posts_for_upload.rb
rebake_quoted_posts_for_user.rb FIX: Move quoted post rebaking on avatar upload to a background job … (#40247) 2026-05-22 14:56:22 -03:00
refresh_users_reviewable_counts.rb DEV: Exclude system users when calculating group user count (#25400) 2024-01-25 08:13:58 +08:00
remove_banner.rb DEV: Update to lastest rubocop-discourse 2024-05-27 18:06:14 +02:00
retrieve_topic.rb DEV: Update to lastest rubocop-discourse 2024-05-27 18:06:14 +02:00
run_heartbeat.rb FIX: Redo Sidekiq monitoring to restart stuck sidekiq processes (#30198) 2024-12-18 12:48:50 +08:00
run_problem_check.rb FIX: Fix scheduled targeted problem checks (#35696) 2025-11-10 10:09:14 +08:00
send_push_notification.rb DEV: Add bypass_time_window arg to SendPushNotification job (#33293) 2025-06-24 09:43:54 -05:00
send_system_message.rb DEV: Update to lastest rubocop-discourse 2024-05-27 18:06:14 +02:00
site_setting_update_default_categories.rb FIX: Timeout issue when updating a large collection of users when changing the default_categories_* and default_tags_* SiteSettings (#33665) 2025-08-20 12:55:53 -05:00
site_setting_update_default_tags.rb FIX: Timeout issue when updating a large collection of users when changing the default_categories_* and default_tags_* SiteSettings (#33665) 2025-08-20 12:55:53 -05:00
suspicious_login.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
sync_access_control_for_uploads.rb DEV: Update uploads:sync_access_control rake task to remove ACLs (#33286) 2025-06-25 15:03:05 +08:00
sync_topic_user_bookmarked.rb DEV: Update to lastest rubocop-discourse 2024-05-27 18:06:14 +02:00
toggle_topic_closed.rb DEV: Replace raw comments with deprecation warnings (#22617) 2023-07-18 10:13:40 +08:00
topic_action_converter.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
topic_timer_base.rb
truncate_user_flag_stats.rb DEV: Update to lastest rubocop-discourse 2024-05-27 18:06:14 +02:00
unpin_topic.rb DEV: Update to lastest rubocop-discourse 2024-05-27 18:06:14 +02:00
update_gravatar.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
update_group_mentions.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
update_hotlinked_raw.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
update_post_uploads_secure_status.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
update_top_redirection.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
update_topic_upload_security.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
update_username.rb PERF: Add indexes to improve user merger performance (#33271) 2025-07-10 18:18:40 -03:00
user_email.rb FIX: Ensure retry_count is set when checking if a job is being retried (#36034) 2025-11-14 14:18:50 +11:00