IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-02-25 18:55:32 -06:00
Code Issues Packages Projects Releases Wiki Activity

SECURITY: Limit URL length for theme remote (#20787)

Browse Source
This commit is contained in:
David Taylor
2023-03-23 12:01:04 +00:00
committed by GitHub
parent 165a3217c8
commit b81767c1b1
4 changed files with 24 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
app/controllers/admin/themes_controller.rb
View File

@@ -3,6 +3,8 @@
require "base64"
class Admin::ThemesController < Admin::AdminController
MAX_REMOTE_LENGTH = 10_000
skip_before_action :check_xhr, only: %i[show preview export]
before_action :ensure_admin
@@ -86,6 +88,12 @@ class Admin::ThemesController < Admin::AdminController
render json: @theme.errors, status: :unprocessable_entity
end
elsif remote = params[:remote]
if remote.length > MAX_REMOTE_LENGTH
error =
I18n.t("themes.import_error.not_allowed_theme", { repo: remote[0..MAX_REMOTE_LENGTH] })
return render_json_error(error, status: 422)
end
begin
guardian.ensure_allowed_theme_repo_import!(remote.strip)
rescue Discourse::InvalidAccess