mirror of
https://github.com/wahyd4/gitlabhq.git
synced 2026-08-10 13:16:09 +10:00
Marin JankovskiandDmitriy Zaporozhets
dd9d17a6e3
Fix note attachments XSS and access control Replaces the reverted #1528, as proposed in https://gitlab.com/gitlab-org/omnibus-gitlab/issues/434, as discussed with @dzaporozhets and as summarized in #2032. @marin Could you take a look at the nginx config and apply it to Omnibus once this gets merged? See merge request !1553
14 lines
257 B
Ruby
14 lines
257 B
Ruby
module Gitlab
|
|
module Middleware
|
|
class Static < ActionDispatch::Static
|
|
UPLOADS_REGEX = /\A\/uploads(\/|\z)/.freeze
|
|
|
|
def call(env)
|
|
return @app.call(env) if env['PATH_INFO'] =~ UPLOADS_REGEX
|
|
|
|
super
|
|
end
|
|
end
|
|
end
|
|
end
|