IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-02-25 18:55:32 -06:00
Code Issues Packages Projects Releases Wiki Activity

FIX: Properly attach secure images to email for non-secure uploads (#23865)

Browse Source 
There are cases where a user can copy image markdown from a public
post (such as via the discourse-templates plugin) into a PM which
is then sent via an email. Since a PM is a secure context (via the
.with_secure_uploads? check on Post), the image will get a secure
URL in the PM post even though the backing upload is not secure.

This fixes the bug in that case where the image would be stripped
from the email (since it had a /secure-uploads/ URL) but not re-attached
further down the line using the secure_uploads_allow_embed_images_in_emails
setting because the upload itself was not secure.

The flow in Email::Sender for doing this is still not ideal, but
there are chicken and egg problems around when to strip the images,
how to fit in with other attachments and email size limits, and
when to apply the images inline via Email::Styles. It's convoluted,
but at least this fixes the Template use case for now.
This commit is contained in:
Martin Brennan
2023-10-17 14:08:21 +10:00
committed by GitHub
parent 09eca87c76
commit 61c87fb59f
6 changed files with 81 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
lib/email/styles.rb
View File

@@ -314,26 +314,36 @@ module Email
@@plugin_callbacks.each { |block| block.call(@fragment, @opts) }
end
def inline_secure_images(attachments, attachments_index)
stripped_media = @fragment.css("[data-stripped-secure-media], [data-stripped-secure-upload]")
upload_shas = {}
stripped_media.each do |div|
url = div["data-stripped-secure-media"] || div["data-stripped-secure-upload"]
filename = File.basename(url)
filename_bare = filename.gsub(File.extname(filename), "")
sha1 = filename_bare.partition("_").first
upload_shas[url] = sha1
end
uploads = Upload.select(:original_filename, :sha1).where(sha1: upload_shas.values)
def stripped_media
@stripped_media ||=
@fragment.css("[data-stripped-secure-media], [data-stripped-secure-upload]")
end
def stripped_upload_sha_map
@stripped_upload_sha_map ||=
begin
upload_shas = {}
stripped_media.each do |div|
url = div["data-stripped-secure-media"] || div["data-stripped-secure-upload"]
upload_shas[url] = Upload.sha1_from_long_url(url)
end
upload_shas
end
end
def stripped_secure_image_uploads
upload_shas = stripped_upload_sha_map
Upload.select(:original_filename, :sha1).where(sha1: upload_shas.values)
end
def inline_secure_images(attachments, attachments_index)
uploads = stripped_secure_image_uploads
upload_shas = stripped_upload_sha_map
stripped_media.each do |div|
upload =
uploads.find do |upl|
upl.sha1 ==
(
upload_shas[div["data-stripped-secure-media"]] ||
upload_shas[div["data-stripped-secure-upload"]]
)
upload_shas[div["data-stripped-secure-media"] || div["data-stripped-secure-upload"]]
end
next if !upload