IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-02-25 18:55:32 -06:00
Code Issues Packages Projects Releases Wiki Activity

DEV: Upload and secure media retroactive rake task improvements (#9027)

Browse Source 
* Add uploads:sync_s3_acls rake task to ensure the ACLs in S3 are the correct (public-read or private) setting based on upload security

* Improved uploads:disable_secure_media to be more efficient and provide better messages to the user.

* Rename uploads:ensure_correct_acl task to uploads:secure_upload_analyse_and_update as it does more than check the ACL

* Many improvements to uploads:secure_upload_analyse_and_update

* Make sure that upload.access_control_post is unscoped so deleted posts are still fetched, because they still affect the security of the upload.

* Add escape hatch for capture_stdout in the form of RAILS_ENABLE_TEST_STDOUT. If provided the capture_stdout code will be ignored, so you can see the output if you need.
This commit is contained in:
Martin Brennan
2020-03-03 10:03:58 +11:00
committed by GitHub
parent 8a696a4ffc
commit 0388653a4d
7 changed files with 271 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
lib/upload_security.rb
View File

@@ -57,9 +57,6 @@ class UploadSecurity
# if there is no access control post id and the upload is currently secure, we
# do not want to make it un-secure to avoid unintentionally exposing it
def access_control_post_has_secure_media?
# if the post is deleted the access_control_post will be blank...
# TODO: deal with this in a better way
return false if @upload.access_control_post.blank?
@upload.access_control_post.with_secure_media?
end