IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-02-25 18:55:32 -06:00
Code Issues Packages Projects Releases Wiki Activity

FIX: Post#each_upload_url yielding external URLs (#27149)

Browse Source 
This commit updates `Post#each_upload_url` to reject URLs that do not
have a host which matches `Discourse.current_hostname` but follows the
`/uploads/short-url` uploads URL format. This situation most commonly
happen when users copy upload URL link between different Discourse
sites.
This commit is contained in:
Alan Guo Xiang Tan
2024-05-23 13:15:16 +08:00
committed by GitHub
parent 13848594d2
commit f84eda7c8d
2 changed files with 34 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
spec/models/post_spec.rb
View File

@@ -2087,6 +2087,25 @@ RSpec.describe Post do
expect(urls).to be_empty
end
it "should skip external URLs following the `/uploads/short-url` pattern if a host is present and the host is not the configured host" do
upload = Fabricate(:upload)
raw = <<~RAW
[Upload link with Discourse.base_url](#{Discourse.base_url}/uploads/short-url/#{upload.sha1}.#{upload.extension})
[Upload link without Discourse.base_url](https://some.other.host/uploads/short-url/#{upload.sha1}.#{upload.extension})
[Upload link without host](/uploads/short-url/#{upload.sha1}.#{upload.extension})
RAW
post = Fabricate(:post, raw: raw)
urls = []
post.each_upload_url { |src, _, _| urls << src }
expect(urls).to contain_exactly(
"#{Discourse.base_url}/uploads/short-url/#{upload.sha1}.#{upload.extension}",
"/uploads/short-url/#{upload.sha1}.#{upload.extension}",
)
end
it "skip S3 cdn urls with different path" do
setup_s3
SiteSetting.Upload.stubs(:s3_cdn_url).returns("https://cdn.example.com/site1")