IntenseWebs/mattermost
3
0
Fork 0
mirror of https://github.com/mattermost/mattermost.git synced 2025-02-25 18:55:24 -06:00
Code Issues Packages Projects Releases Wiki Activity

Fully deprecate /api/v4/image endpoint when image proxy is disabled (#27595)

Browse Source 
Co-authored-by: Mattermost Build <build@mattermost.com>
This commit is contained in:
Claudio Costa 2024-08-05 12:33:09 +02:00 committed by GitHub
parent 1158e6358c
commit f290745496
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 14 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
server/channels/api4/image.go
View File

@ -37,10 +37,17 @@ func getImage(c *Context, w http.ResponseWriter, r *http.Request) {
parsedURL.Host = siteURL.Host parsedURL.Host = siteURL.Host
} }
if *c.App.Config().ImageProxySettings.Enable {
// in case image proxy is enabled and we are fetching a remote image (NOT static or served by plugins), pass request to proxy // in case image proxy is enabled and we are fetching a remote image (NOT static or served by plugins), pass request to proxy
if *c.App.Config().ImageProxySettings.Enable && parsedURL.Host != siteURL.Host { if parsedURL.Host != siteURL.Host {
c.App.ImageProxy().GetImage(w, r, parsedURL.String()) c.App.ImageProxy().GetImage(w, r, parsedURL.String())
} else { } else {
// Otherwise we redirect.
http.Redirect(w, r, parsedURL.String(), http.StatusFound) http.Redirect(w, r, parsedURL.String(), http.StatusFound)
} }
return
}
// When proxy disabled this endpoint should fail as we don't support redirecting to external images any longer (MM-54477).
c.Err = model.NewAppError("getImage", "api.image.get.app_error", nil, "", http.StatusBadRequest)
} }

4
server/channels/api4/image_test.go
View File

@ -37,10 +37,10 @@ func TestGetImage(t *testing.T) {
require.NoError(t, err) require.NoError(t, err)
r.Header.Set(model.HeaderAuth, th.Client.AuthType+" "+th.Client.AuthToken) r.Header.Set(model.HeaderAuth, th.Client.AuthType+" "+th.Client.AuthToken)
// External images should not be allowed through this endpoint when proxy is disabled.
resp, err := th.Client.HTTPClient.Do(r) resp, err := th.Client.HTTPClient.Do(r)
require.NoError(t, err) require.NoError(t, err)
assert.Equal(t, http.StatusFound, resp.StatusCode) assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
assert.Equal(t, imageURL, resp.Header.Get("Location"))
}) })
t.Run("atmos/camo", func(t *testing.T) { t.Run("atmos/camo", func(t *testing.T) {