mirror of
https://github.com/wahyd4/gitlabhq.git
synced 2026-08-20 01:56:06 +10:00
Marin JankovskiandDmitriy Zaporozhets
dd9d17a6e3
Fix note attachments XSS and access control Replaces the reverted #1528, as proposed in https://gitlab.com/gitlab-org/omnibus-gitlab/issues/434, as discussed with @dzaporozhets and as summarized in #2032. @marin Could you take a look at the nginx config and apply it to Omnibus once this gets merged? See merge request !1553
18 lines
518 B
Ruby
18 lines
518 B
Ruby
class UploadsController < ApplicationController
|
|
def show
|
|
model = params[:model].camelize.constantize.find(params[:id])
|
|
uploader = model.send(params[:mounted_as])
|
|
|
|
if uploader.file_storage?
|
|
if !model.respond_to?(:project) || can?(current_user, :read_project, model.project)
|
|
disposition = uploader.image? ? 'inline' : 'attachment'
|
|
send_file uploader.file.path, disposition: disposition
|
|
else
|
|
not_found!
|
|
end
|
|
else
|
|
redirect_to uploader.url
|
|
end
|
|
end
|
|
end
|