diff options
author | Marin Jankovski <marin@gitlab.com> | 2015-02-20 22:47:54 +0000 |
---|---|---|
committer | Marin Jankovski <marin@gitlab.com> | 2015-02-20 22:47:54 +0000 |
commit | 8ae3112b3f303c897c70952dd162589b1c394221 (patch) | |
tree | f1ee6b9013604a688cd06c75cc64650c564b3ff2 /app/controllers | |
parent | acc312fc257cd8534ccbbeab6e7bf70dca60279b (diff) | |
parent | 26d57a648c09f40bd1da3c81a0efe3661288b1af (diff) | |
download | gitlab-ce-8ae3112b3f303c897c70952dd162589b1c394221.tar.gz |
Merge branch 'upload-xss-access-control' into 'master'
Fix note attachments XSS and access control
Replaces the reverted #1528, as proposed in https://gitlab.com/gitlab-org/omnibus-gitlab/issues/434, as discussed with @dzaporozhets and as summarized in #2032.
@marin Could you take a look at the nginx config and apply it to Omnibus once this gets merged?
See merge request !1553
Diffstat (limited to 'app/controllers')
-rw-r--r-- | app/controllers/projects/uploads_controller.rb | 19 | ||||
-rw-r--r-- | app/controllers/uploads_controller.rb | 17 |
2 files changed, 36 insertions, 0 deletions
diff --git a/app/controllers/projects/uploads_controller.rb b/app/controllers/projects/uploads_controller.rb new file mode 100644 index 00000000000..2b4da35bc7f --- /dev/null +++ b/app/controllers/projects/uploads_controller.rb @@ -0,0 +1,19 @@ +class Projects::UploadsController < Projects::ApplicationController + layout "project" + + before_filter :project + + def show + path = File.join(project.path_with_namespace, params[:secret]) + uploader = FileUploader.new('uploads', path) + + uploader.retrieve_from_store!(params[:filename]) + + if uploader.file.exists? + # Right now, these are always images, so we can safely render them inline. + send_file uploader.file.path, disposition: 'inline' + else + not_found! + end + end +end diff --git a/app/controllers/uploads_controller.rb b/app/controllers/uploads_controller.rb new file mode 100644 index 00000000000..d5877977258 --- /dev/null +++ b/app/controllers/uploads_controller.rb @@ -0,0 +1,17 @@ +class UploadsController < ApplicationController + def show + model = params[:model].camelize.constantize.find(params[:id]) + uploader = model.send(params[:mounted_as]) + + if uploader.file_storage? + if !model.respond_to?(:project) || can?(current_user, :read_project, model.project) + disposition = uploader.image? ? 'inline' : 'attachment' + send_file uploader.file.path, disposition: disposition + else + not_found! + end + else + redirect_to uploader.url + end + end +end |