Disallow protected upload paths for non-native files
Fixes CODEOCEAN-E0
This commit is contained in:
@ -23,7 +23,7 @@ module CodeOcean
|
|||||||
@file = CodeOcean::File.find(params[:id])
|
@file = CodeOcean::File.find(params[:id])
|
||||||
authorize!
|
authorize!
|
||||||
# The `@file.name_with_extension` is assembled based on the user-selected file type, not on the actual file name stored on disk.
|
# The `@file.name_with_extension` is assembled based on the user-selected file type, not on the actual file name stored on disk.
|
||||||
raise Pundit::NotAuthorizedError if @embed_options[:disable_download] || @file.filepath != params[:filename]
|
raise Pundit::NotAuthorizedError if @embed_options[:disable_download] || @file.filepath != params[:filename] || @file.native_file.blank?
|
||||||
|
|
||||||
real_location = Pathname(@file.native_file.current_path).realpath
|
real_location = Pathname(@file.native_file.current_path).realpath
|
||||||
send_file(real_location, type: 'application/octet-stream', filename: @file.name_with_extension, disposition: 'attachment')
|
send_file(real_location, type: 'application/octet-stream', filename: @file.name_with_extension, disposition: 'attachment')
|
||||||
@ -36,7 +36,7 @@ module CodeOcean
|
|||||||
@file = authorize AuthenticatedUrlHelper.retrieve!(CodeOcean::File, request)
|
@file = authorize AuthenticatedUrlHelper.retrieve!(CodeOcean::File, request)
|
||||||
|
|
||||||
# The `@file.name_with_extension` is assembled based on the user-selected file type, not on the actual file name stored on disk.
|
# The `@file.name_with_extension` is assembled based on the user-selected file type, not on the actual file name stored on disk.
|
||||||
raise Pundit::NotAuthorizedError unless @file.filepath == params[:filename]
|
raise Pundit::NotAuthorizedError unless @file.filepath == params[:filename] || @file.native_file.present?
|
||||||
|
|
||||||
real_location = Pathname(@file.native_file.current_path).realpath
|
real_location = Pathname(@file.native_file.current_path).realpath
|
||||||
send_file(real_location, type: @file.native_file.content_type, filename: @file.name_with_extension)
|
send_file(real_location, type: @file.native_file.content_type, filename: @file.name_with_extension)
|
||||||
|
Reference in New Issue
Block a user