mirror of
https://github.com/wahyd4/gitlabhq.git
synced 2026-08-10 13:16:09 +10:00
Marin JankovskiandDmitriy Zaporozhets
dd9d17a6e3
Fix note attachments XSS and access control Replaces the reverted #1528, as proposed in https://gitlab.com/gitlab-org/omnibus-gitlab/issues/434, as discussed with @dzaporozhets and as summarized in #2032. @marin Could you take a look at the nginx config and apply it to Omnibus once this gets merged? See merge request !1553
20 lines
508 B
Ruby
20 lines
508 B
Ruby
class Projects::UploadsController < Projects::ApplicationController
|
|
layout "project"
|
|
|
|
before_filter :project
|
|
|
|
def show
|
|
path = File.join(project.path_with_namespace, params[:secret])
|
|
uploader = FileUploader.new('uploads', path)
|
|
|
|
uploader.retrieve_from_store!(params[:filename])
|
|
|
|
if uploader.file.exists?
|
|
# Right now, these are always images, so we can safely render them inline.
|
|
send_file uploader.file.path, disposition: 'inline'
|
|
else
|
|
not_found!
|
|
end
|
|
end
|
|
end
|