mirror of
https://github.com/discourse/discourse.git
synced 2026-08-09 21:45:25 +08:00
eff53af263
Backport of #705 to release/2026.1. --- Advisory: https://github.com/discourse/discourse/security/advisories/GHSA-3876-w96v-8v38 When a post embeds an `<img>` pointing at a secure-uploads URL whose upload is owned by an access-controlled post (for example a private category), `Jobs::PullHotlinkedImages` would resolve the presigned S3 URL and attach a fresh local copy of the upload to the embedding post regardless of whether its author could see the original. A user could hotlink the secure-uploads URL of media they should not have access to into a post they authored, and `Jobs::PullHotlinkedImages` would create a fresh local copy attached to their post. This commit gates `Jobs::PullHotlinkedImages#should_download_image?` on a new `can_see_upload?` helper. For secure uploads the helper checks the post author against the upload's `access_control_post` with `user.guardian.can_see_post?`. When the author cannot see the access-control post, the job leaves the original secure URL in place and does not create a local copy. |
||
|---|---|---|
| .. | ||
| concerns | ||
| onceoff | ||
| regular | ||
| scheduled | ||
| base.rb | ||
