diff options
| author | Jan Provaznik <jprovaznik@gitlab.com> | 2018-07-07 19:30:16 +0200 |
|---|---|---|
| committer | Jan Provaznik <jprovaznik@gitlab.com> | 2018-07-08 10:43:57 +0200 |
| commit | e2ec97a92e6393dd0adeed39c77ff2b4eba0aed9 (patch) | |
| tree | 972840ffe1bb8787b27d2d5b837b64d606d1b5a7 /changelogs | |
| parent | 96eb6fd33b5dfc4910d8bd93e697d6b6eb70b991 (diff) | |
| download | gitlab-ce-e2ec97a92e6393dd0adeed39c77ff2b4eba0aed9.tar.gz | |
Add FileUploader.root to allowed upload paths
Currently we check if uploaded file is under
`Gitlab.config.uploads.storage_path`, the problem is that
uploads are placed in `uploads` subdirectory which is symlink.
In allow_path? method we check real (expanded) paths, which causes
that `Gitlab.config.uploads.storage_path` is expaned into symlink
path and there is a mismatch with upload file path.
By adding `Gitlab.config.uploads.storage_path/uploads` into allowed
paths, this path is expaned during path check.
`Gitlab.config.uploads.storage_path` is left there intentionally in case
some uploader wouldn't use `uploads` subdir.
Diffstat (limited to 'changelogs')
| -rw-r--r-- | changelogs/unreleased/jprovazn-upload-symlink.yml | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/changelogs/unreleased/jprovazn-upload-symlink.yml b/changelogs/unreleased/jprovazn-upload-symlink.yml new file mode 100644 index 00000000000..265791d332f --- /dev/null +++ b/changelogs/unreleased/jprovazn-upload-symlink.yml @@ -0,0 +1,5 @@ +--- +title: Add /uploads subdirectory to allowed upload paths. +merge_request: +author: +type: fixed |