codeninjasllc/discourse
1
0
Fork 0
mirror of https://github.com/codeninjasllc/discourse.git synced 2024-12-17 19:12:37 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

FIX: do not store incoming links on avatars or uploads

Browse source
This commit is contained in:
Sam 2014-07-25 15:10:06 +10:00
parent 95d13bf68a
commit 40af9ce612
4 changed files with 8 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
app/controllers/static_controller.rb
View file

@ -62,7 +62,7 @@ class StaticController < ApplicationController
) )
end end
skip_before_filter :verify_authenticity_token, only: [:cdn_asset] skip_before_filter :store_incoming_links, :verify_authenticity_token, only: [:cdn_asset]
def cdn_asset def cdn_asset
path = File.expand_path(Rails.root + "public/assets/" + params[:path]) path = File.expand_path(Rails.root + "public/assets/" + params[:path])

2
app/controllers/uploads_controller.rb
View file

@ -1,6 +1,6 @@
class UploadsController < ApplicationController class UploadsController < ApplicationController
before_filter :ensure_logged_in, except: [:show] before_filter :ensure_logged_in, except: [:show]
skip_before_filter :check_xhr, only: [:show] skip_before_filter :store_incoming_links, :check_xhr, only: [:show]
def create def create
file = params[:file] || params[:files].first file = params[:file] || params[:files].first

2
app/controllers/user_avatars_controller.rb
View file

@ -3,7 +3,7 @@ require_dependency 'letter_avatar'
class UserAvatarsController < ApplicationController class UserAvatarsController < ApplicationController
DOT = Base64.decode64("R0lGODlhAQABALMAAAAAAIAAAACAAICAAAAAgIAAgACAgMDAwICAgP8AAAD/AP//AAAA//8A/wD//wBiZCH5BAEAAA8ALAAAAAABAAEAAAQC8EUAOw==") DOT = Base64.decode64("R0lGODlhAQABALMAAAAAAIAAAACAAICAAAAAgIAAgACAgMDAwICAgP8AAAD/AP//AAAA//8A/wD//wBiZCH5BAEAAA8ALAAAAAABAAEAAAQC8EUAOw==")
skip_before_filter :redirect_to_login_if_required, :check_xhr, :verify_authenticity_token, only: [:show, :show_letter] skip_before_filter :store_incoming_links, :redirect_to_login_if_required, :check_xhr, :verify_authenticity_token, only: [:show, :show_letter]
def refresh_gravatar def refresh_gravatar
user = User.find_by(username_lower: params[:username].downcase) user = User.find_by(username_lower: params[:username].downcase)

5
db/migrate/20140725050636_remove_invalid_incoming_links.rb Normal file
View file

@ -0,0 +1,5 @@
class RemoveInvalidIncomingLinks < ActiveRecord::Migration
def change
execute "DELETE FROM incoming_links WHERE url ILIKE '%avatar%.png'"
end
end