mirror of
https://github.com/wahyd4/gitlabhq.git
synced 2026-08-09 04:36:11 +10:00
Robert SpeicherandTomasz Maczukin
6de76857d1
Forbid scripting for wiki files Wiki files (not pages - files in the repo) are just sent to the browser with whatever content-type the mime_types gem assigns to them based on their extension. As this is from the same domain as the GitLab application, this is an XSS vulnerability. Set a CSP forbidding all sources for scripting, CSS, XHR, etc. on these files. Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/17298. See merge request !1969
126 lines
3.0 KiB
Ruby
126 lines
3.0 KiB
Ruby
require 'project_wiki'
|
|
|
|
class Projects::WikisController < Projects::ApplicationController
|
|
before_action :authorize_read_wiki!
|
|
before_action :authorize_create_wiki!, only: [:edit, :create, :history]
|
|
before_action :authorize_admin_wiki!, only: :destroy
|
|
before_action :load_project_wiki
|
|
|
|
def pages
|
|
@wiki_pages = Kaminari.paginate_array(@project_wiki.pages).page(params[:page]).per(PER_PAGE)
|
|
end
|
|
|
|
def show
|
|
@page = @project_wiki.find_page(params[:id], params[:version_id])
|
|
|
|
if @page
|
|
render 'show'
|
|
elsif file = @project_wiki.find_file(params[:id], params[:version_id])
|
|
response.headers['Content-Security-Policy'] = "default-src 'none'"
|
|
response.headers['X-Content-Security-Policy'] = "default-src 'none'"
|
|
|
|
if file.on_disk?
|
|
send_file file.on_disk_path, disposition: 'inline'
|
|
else
|
|
send_data(
|
|
file.raw_data,
|
|
type: file.mime_type,
|
|
disposition: 'inline',
|
|
filename: file.name
|
|
)
|
|
end
|
|
else
|
|
return render('empty') unless can?(current_user, :create_wiki, @project)
|
|
@page = WikiPage.new(@project_wiki)
|
|
@page.title = params[:id]
|
|
|
|
render 'edit'
|
|
end
|
|
end
|
|
|
|
def edit
|
|
@page = @project_wiki.find_page(params[:id])
|
|
end
|
|
|
|
def update
|
|
@page = @project_wiki.find_page(params[:id])
|
|
|
|
return render('empty') unless can?(current_user, :create_wiki, @project)
|
|
|
|
if @page.update(content, format, message)
|
|
redirect_to(
|
|
namespace_project_wiki_path(@project.namespace, @project, @page),
|
|
notice: 'Wiki was successfully updated.'
|
|
)
|
|
else
|
|
render 'edit'
|
|
end
|
|
end
|
|
|
|
def create
|
|
@page = WikiPage.new(@project_wiki)
|
|
|
|
if @page.create(wiki_params)
|
|
redirect_to(
|
|
namespace_project_wiki_path(@project.namespace, @project, @page),
|
|
notice: 'Wiki was successfully updated.'
|
|
)
|
|
else
|
|
render action: "edit"
|
|
end
|
|
end
|
|
|
|
def history
|
|
@page = @project_wiki.find_page(params[:id])
|
|
|
|
unless @page
|
|
redirect_to(
|
|
namespace_project_wiki_path(@project.namespace, @project, :home),
|
|
notice: "Page not found"
|
|
)
|
|
end
|
|
end
|
|
|
|
def destroy
|
|
@page = @project_wiki.find_page(params[:id])
|
|
@page.delete if @page
|
|
|
|
redirect_to(
|
|
namespace_project_wiki_path(@project.namespace, @project, :home),
|
|
notice: "Page was successfully deleted"
|
|
)
|
|
end
|
|
|
|
def git_access
|
|
end
|
|
|
|
private
|
|
|
|
def load_project_wiki
|
|
@project_wiki = ProjectWiki.new(@project, current_user)
|
|
|
|
# Call #wiki to make sure the Wiki Repo is initialized
|
|
@project_wiki.wiki
|
|
rescue ProjectWiki::CouldNotCreateWikiError
|
|
flash[:notice] = "Could not create Wiki Repository at this time. Please try again later."
|
|
redirect_to project_path(@project)
|
|
return false
|
|
end
|
|
|
|
def wiki_params
|
|
params[:wiki].slice(:title, :content, :format, :message)
|
|
end
|
|
|
|
def content
|
|
params[:wiki][:content]
|
|
end
|
|
|
|
def format
|
|
params[:wiki][:format]
|
|
end
|
|
|
|
def message
|
|
params[:wiki][:message]
|
|
end
|
|
end
|