Discource-C
/
discourse
mirror of https://github.com/discourse/discourse.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SECURITY: do not follow redirect by default when downloading hotlinked images

This commit is contained in:
Régis Hanol 2014-07-27 17:21:47 +02:00
parent 621b86dbb3
commit 488d4eebbe
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
lib/file_helper.rb
View File

@ -6,7 +6,7 @@ class FileHelper
filename =~ images_regexp filename =~ images_regexp
end end
def self.download(url, max_file_size, tmp_file_name) def self.download(url, max_file_size, tmp_file_name, follow_redirect=false)
raise Discourse::InvalidParameters.new(:url) unless url =~ /^https?:\/\// raise Discourse::InvalidParameters.new(:url) unless url =~ /^https?:\/\//
uri = URI.parse(url) uri = URI.parse(url)
@ -14,7 +14,7 @@ class FileHelper
tmp = Tempfile.new([tmp_file_name, extension]) tmp = Tempfile.new([tmp_file_name, extension])
File.open(tmp.path, "wb") do |f| File.open(tmp.path, "wb") do |f|
downloaded = uri.open("rb", read_timeout: 5) downloaded = uri.open("rb", read_timeout: 5, redirect: follow_redirect)
while f.size <= max_file_size && data = downloaded.read(max_file_size) while f.size <= max_file_size && data = downloaded.read(max_file_size)
f.write(data) f.write(data)
end end