Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
Code Packages Activity Actions
discourse/app/controllers/admin
History
Exact
Bannon Tanner fc96c733db
 FIX: Validate resumableFilename in check_backup_chunk to prevent path traversa... (#42098) 
## Summary

Correctly validate the `resumableFilename` parameter in the
`check_backup_chunk` endpoint before constructing any filesystem path.
Previously, only the identifier was validated, allowing path traversal
sequences to expose an existence-and-size oracle for `.part` chunk files
outside the intended upload directory. The fix applies the existing
`valid_filename?` check to the filename parameter, matching the
protection already present on the upload endpoint.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1558

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-07-28 11:18:14 -05:00
..
config FEATURE: Category management UI for admins (#41218) 2026-07-15 09:17:25 +10:00
admin_controller.rb
admin_notices_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
api_controller.rb DEV: Tidy plugin API key scope resource names (#38640) 2026-03-17 13:03:42 +11:00
backups_controller.rb FIX: Validate resumableFilename in check_backup_chunk to prevent path traversa... (#42098) 2026-07-28 11:18:14 -05:00
badges_controller.rb FIX: ensures admin can't set system property on badges (#37820) 2026-02-16 12:33:32 +01:00
color_schemes_controller.rb FEATURE: Allow editing theme-owned palettes (#34722) 2025-10-06 09:02:39 +03:00
dashboard_controller.rb DEV: Serialize dashboard sections for flamegraph profiling (#41897) 2026-07-23 07:49:58 +08:00
email_controller.rb DEV: Fix job serialization deprecation in email controller (#39311) 2026-04-16 11:42:34 +02:00
email_logs_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
email_styles_controller.rb
email_templates_controller.rb FEATURE: Log in with a one-time email code (#40804) 2026-06-17 12:34:48 -07:00
embeddable_hosts_controller.rb DEV: Expand top_tags, topic.tags, etc, to return an array of tag objects instead of tag names (#36678) 2026-02-02 10:03:02 +08:00
embedding_controller.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
emoji_controller.rb UX: Better admin emoji page sorting & filtering and service refactors (#41892) 2026-07-24 12:01:21 +10:00
form_templates_controller.rb FIX: Form templates page returning 500 error (#39799) 2026-05-06 18:53:52 +02:00
groups_controller.rb UX: Normalize automatic membership email domains (#41434) 2026-07-03 17:22:18 +02:00
impersonate_controller.rb FEATURE: Impersonation countdown (#39871) 2026-05-12 12:12:25 +08:00
onboarding_events_controller.rb FEATURE: Log staff actions for admin onboarding panel steps (#42032) 2026-07-24 14:43:01 -07:00
permalinks_controller.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
plugins_controller.rb
problem_checks_controller.rb FEATURE: Add problem checks page to admin panel and allow ignoring problem checks (#39103) 2026-04-23 08:28:33 +08:00
reports_controller.rb FIX: Suspicious login IPs bypass the moderator IP-visibility setting (#40154) 2026-05-22 13:22:32 +08:00
robots_txt_controller.rb FIX: Log changes to robots.txt by admins (#37901) 2026-02-18 14:20:21 -05:00
screened_emails_controller.rb
screened_ip_addresses_controller.rb DEV: Require admin for allow_admin screened IP mutations (#38545) 2026-03-12 10:43:19 -07:00
screened_urls_controller.rb
search_controller.rb DEV: Rename anonymous group to anonymous_users (#40435) 2026-06-02 09:29:46 +10:00
search_logs_controller.rb
section_controller.rb
site_settings_controller.rb UX: Link to required settings from language switcher validation error (#38374) 2026-07-16 15:51:06 -04:00
site_texts_controller.rb UX: Don't include powered_by string in site text overrides (#39660) 2026-04-30 12:15:34 -04:00
staff_action_logs_controller.rb DEV: Add comparison budget to ONPDiff (#38063) 2026-02-25 14:25:03 -05:00
staff_controller.rb
themes_controller.rb DEV: Improve handling of private theme installs (#41845) 2026-07-24 13:42:41 -04:00
unknown_reviewables_controller.rb FEATURE: Gracefully handle unhandled reviewables (#31118) 2025-02-05 14:38:45 +11:00
user_fields_controller.rb DEV: Update rubocop (#38721) 2026-03-20 00:39:52 +01:00
users_controller.rb FIX: Preserve "+" in server-side sync_sso payloads (#42024) 2026-07-24 16:28:56 +02:00
versions_controller.rb
watched_words_controller.rb DEV: Deferred upload accesses tempfile after request completes (#38337) 2026-03-10 07:53:29 -07:00
web_hooks_controller.rb FIX: Allow selecting tags when creating or editing webhooks (#37942) 2026-02-20 23:00:50 +08:00