Discource-C
/
discourse
mirror of https://github.com/discourse/discourse.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
discourse/spec/requests
History
Martin Brennan 7c32411881
FEATURE: Secure media allowing duplicated uploads with category-level privacy and post-based access rules (#8664) 
### General Changes and Duplication

* We now consider a post `with_secure_media?` if it is in a read-restricted category.
* When uploading we now set an upload's secure status straight away.
* When uploading if `SiteSetting.secure_media` is enabled, we do not check to see if the upload already exists using the `sha1` digest of the upload. The `sha1` column of the upload is filled with a `SecureRandom.hex(20)` value which is the same length as `Upload::SHA1_LENGTH`. The `original_sha1` column is filled with the _real_ sha1 digest of the file. 
* Whether an upload `should_be_secure?` is now determined by whether the `access_control_post` is `with_secure_media?` (if there is no access control post then we leave the secure status as is).
* When serializing the upload, we now cook the URL if the upload is secure. This is so it shows up correctly in the composer preview, because we set secure status on upload.

### Viewing Secure Media

* The secure-media-upload URL will take the post that the upload is attached to into account via `Guardian.can_see?` for access permissions
* If there is no `access_control_post` then we just deliver the media. This should be a rare occurrance and shouldn't cause issues as the `access_control_post` is set when `link_post_uploads` is called via `CookedPostProcessor`

### Removed

We no longer do any of these because we do not reuse uploads by sha1 if secure media is enabled.

* We no longer have a way to prevent cross-posting of a secure upload from a private context to a public context.
* We no longer have to set `secure: false` for uploads when uploading for a theme component.
 		2020-01-16 13:50:27 +10:00
..
admin FEATURE: Secure media allowing duplicated uploads with category-level privacy and post-based access rules (#8664) 2020-01-16 13:50:27 +10:00
about_controller_spec.rb DEV: use #frozen_string_literal: true on all spec 2019-04-30 10:27:42 +10:00
application_controller_spec.rb SECURITY: 2FA with U2F / TOTP 2020-01-15 11:27:12 +01:00
associate_accounts_controller_spec.rb DEV: Add test to ensure :after_auth event is triggered (#8400) 2019-11-25 14:31:57 +02:00
badges_controller_spec.rb DEV: Upgrade Discourse to Rails 6 (#8083) 2019-09-12 10:41:50 +10:00
bookmarks_controller_spec.rb Improving bookmarks part 1 (#8466) 2019-12-11 14:04:02 +10:00
categories_controller_spec.rb FIX: unable to remove required tag group from a category 2019-11-18 15:54:00 -05:00
category_hashtags_controller_spec.rb DEV: avoid double sign-in which can lead to flaky tests 2019-06-03 10:15:49 +10:00
clicks_controller_spec.rb DEV: Fix failling test. 2019-05-07 11:19:13 +03:00
composer_controller_spec.rb DEV: Prefabrication (test optimization) (#7414) 2019-05-07 13:12:20 +10:00
composer_messages_controller_spec.rb DEV: Prefabrication (test optimization) (#7414) 2019-05-07 13:12:20 +10:00
csp_reports_controller_spec.rb DEV: use #frozen_string_literal: true on all spec 2019-04-30 10:27:42 +10:00
directory_items_controller_spec.rb DEV: Prefabrication (test optimization) (#7414) 2019-05-07 13:12:20 +10:00
draft_controller_spec.rb FIX: under some conditions draft would say it was saving when not 2019-10-31 17:15:58 +11:00
drafts_controller_spec.rb DEV: use #frozen_string_literal: true on all spec 2019-04-30 10:27:42 +10:00
email_controller_spec.rb DEV: Implement a faster Discourse.cache 2019-11-27 16:11:49 +11:00
embed_controller_spec.rb FEATURE: Overhaul of admin API key system (#8284) 2019-11-05 14:10:23 +00:00
exceptions_controller_spec.rb DEV: use #frozen_string_literal: true on all spec 2019-04-30 10:27:42 +10:00
export_csv_controller_spec.rb fix the build (take 2). 2019-12-24 19:27:35 +05:30
extra_locales_controller_spec.rb FIX: Better error handling for invalid locale bundle versions 2019-11-11 22:30:32 +01:00
finish_installation_controller_spec.rb DEV: use #frozen_string_literal: true on all spec 2019-04-30 10:27:42 +10:00
forums_controller_spec.rb FIX: Don't use DistributedCache to store redis readonly state 2019-06-25 11:20:34 +08:00
groups_controller_spec.rb FIX: group membership leak 2020-01-15 11:21:58 +01:00
inline_onebox_controller_spec.rb DEV: Prefabrication (test optimization) (#7414) 2019-05-07 13:12:20 +10:00
invites_controller_spec.rb FEATURE: Add timezone to core user_options (#8380) 2019-11-25 10:49:27 +10:00
list_controller_spec.rb FIX: Replace deprecated URI.encode, URI.escape, URI.unescape and URI.unencode (#8528) 2019-12-12 12:49:21 +10:00
metadata_controller_spec.rb DEV: Upgrade Discourse to Rails 6 (#8083) 2019-09-12 10:41:50 +10:00
notifications_controller_spec.rb DEV: Prefer `public_send` over `send`. 2019-05-07 09:33:21 +08:00
offline_controller_spec.rb DEV: use #frozen_string_literal: true on all spec 2019-04-30 10:27:42 +10:00
omniauth_callbacks_controller_spec.rb SECURITY: 2FA with U2F / TOTP 2020-01-15 11:27:12 +01:00
onebox_controller_spec.rb FIX: Cache failed onebox URL request server-side (#8421) 2019-11-28 07:48:29 +10:00
permalinks_controller_spec.rb DEV: improve usability of subfolder specs 2019-11-15 16:48:24 +11:00
post_action_users_controller_spec.rb More prefabrication 2019-05-10 08:34:04 -04:00
post_actions_controller_spec.rb DEV: Prefabrication (test optimization) (#7414) 2019-05-07 13:12:20 +10:00
post_readers_controller_spec.rb FIX: Filter readers avatars correctly when the post is a whisper 2019-12-03 10:50:02 -03:00
posts_controller_spec.rb FEATURE: Allow complex post params from plugin (#8598) 2019-12-20 10:37:12 -06:00
push_notification_controller_spec.rb DEV: Prefabrication (test optimization) (#7414) 2019-05-07 13:12:20 +10:00
reviewable_claimed_topics_controller_spec.rb FIX: Don't log a claimed topic database error during tests 2020-01-09 12:32:05 -05:00
reviewables_controller_spec.rb FEATURE: Filter reviewables by date range (#8354) 2019-11-15 15:29:59 -03:00
robots_txt_controller_spec.rb DEV: improve usability of subfolder specs 2019-11-15 16:48:24 +11:00
safe_mode_controller_spec.rb DEV: use #frozen_string_literal: true on all spec 2019-04-30 10:27:42 +10:00
search_controller_spec.rb DEV: s/\$redis/Discourse\.redis (#8431) 2019-12-03 10:05:53 +01:00
session_controller_spec.rb SECURITY: 2FA with U2F / TOTP 2020-01-15 11:27:12 +01:00
similar_topics_controller_spec.rb DEV: use #frozen_string_literal: true on all spec 2019-04-30 10:27:42 +10:00
site_controller_spec.rb DEV: use #frozen_string_literal: true on all spec 2019-04-30 10:27:42 +10:00
static_controller_spec.rb DEV: Upgrade Discourse to Rails 6 (#8083) 2019-09-12 10:41:50 +10:00
steps_controller_spec.rb DEV: use #frozen_string_literal: true on all spec 2019-04-30 10:27:42 +10:00
stylesheets_controller_spec.rb DEV: use #frozen_string_literal: true on all spec 2019-04-30 10:27:42 +10:00
svg_sprite_controller_spec.rb DEV: use #frozen_string_literal: true on all spec 2019-04-30 10:27:42 +10:00
tag_groups_controller_spec.rb DEV: Prefabrication (test optimization) (#7414) 2019-05-07 13:12:20 +10:00
tags_controller_spec.rb FIX: tag input doesn't show all top 5 permitted tags 2019-12-10 10:30:01 -05:00
theme_javascripts_controller_spec.rb DEV: Prefabrication (test optimization) (#7414) 2019-05-07 13:12:20 +10:00
topics_controller_spec.rb FIX: better error message when topic deletion fails 2020-01-15 19:30:06 +05:30
uploads_controller_spec.rb FEATURE: Secure media allowing duplicated uploads with category-level privacy and post-based access rules (#8664) 2020-01-16 13:50:27 +10:00
user_actions_controller_spec.rb DEV: use #frozen_string_literal: true on all spec 2019-04-30 10:27:42 +10:00
user_api_keys_controller_spec.rb SECURITY: Correct permission check when revoking user API keys 2019-12-17 10:56:16 +00:00
user_avatars_controller_spec.rb DEV: use #frozen_string_literal: true on all spec 2019-04-30 10:27:42 +10:00
user_badges_controller_spec.rb DEV: improve usability of subfolder specs 2019-11-15 16:48:24 +11:00
users_controller_spec.rb SECURITY: 2FA with U2F / TOTP 2020-01-15 11:27:12 +01:00
users_email_controller_spec.rb SECURITY: 2FA with U2F / TOTP 2020-01-15 11:27:12 +01:00
webhooks_controller_spec.rb DEV: s/\$redis/Discourse\.redis (#8431) 2019-12-03 10:05:53 +01:00
wizard_controller_spec.rb DEV: use #frozen_string_literal: true on all spec 2019-04-30 10:27:42 +10:00