Switch from serving a 400 to a 302
This commit is contained in:
parent
da7394f33b
commit
b3c3bd99c3
@ -1 +1 @@
|
||||
Validate Host header for MediaProxy and Uploads
|
||||
Validate Host header for MediaProxy and Uploads and return a 302 if the base_url has changed
|
||||
|
@ -207,12 +207,25 @@ defmodule Pleroma.Web.MediaProxy.MediaProxyController do
|
||||
end
|
||||
|
||||
defp validate_host(conn, _params) do
|
||||
proxy_host = MediaProxy.base_url() |> URI.parse() |> Map.get(:host)
|
||||
%{scheme: proxy_scheme, host: proxy_host, port: proxy_port} =
|
||||
MediaProxy.base_url() |> URI.parse()
|
||||
|
||||
if match?(^proxy_host, conn.host) do
|
||||
conn
|
||||
else
|
||||
send_resp(conn, 400, Conn.Status.reason_phrase(400))
|
||||
redirect_url =
|
||||
%URI{
|
||||
scheme: proxy_scheme,
|
||||
host: proxy_host,
|
||||
port: proxy_port,
|
||||
path: conn.request_path,
|
||||
query: conn.query_string
|
||||
}
|
||||
|> URI.to_string()
|
||||
|> String.trim_trailing("?")
|
||||
|
||||
conn
|
||||
|> Phoenix.Controller.redirect(external: redirect_url)
|
||||
|> halt()
|
||||
end
|
||||
end
|
||||
|
@ -46,7 +46,8 @@ defmodule Pleroma.Web.Plugs.UploadedMedia do
|
||||
|
||||
config = Pleroma.Config.get(Pleroma.Upload)
|
||||
|
||||
media_host = Pleroma.Upload.base_url() |> URI.parse() |> Map.get(:host)
|
||||
%{scheme: media_scheme, host: media_host, port: media_port} =
|
||||
Pleroma.Upload.base_url() |> URI.parse()
|
||||
|
||||
with {:valid_host, true} <- {:valid_host, match?(^media_host, conn.host)},
|
||||
uploader <- Keyword.fetch!(config, :uploader),
|
||||
@ -56,7 +57,19 @@ defmodule Pleroma.Web.Plugs.UploadedMedia do
|
||||
get_media(conn, get_method, proxy_remote, opts)
|
||||
else
|
||||
{:valid_host, false} ->
|
||||
send_resp(conn, 400, Plug.Conn.Status.reason_phrase(400))
|
||||
redirect_url =
|
||||
%URI{
|
||||
scheme: media_scheme,
|
||||
host: media_host,
|
||||
port: media_port,
|
||||
path: conn.request_path,
|
||||
query: conn.query_string
|
||||
}
|
||||
|> URI.to_string()
|
||||
|> String.trim_trailing("?")
|
||||
|
||||
conn
|
||||
|> Phoenix.Controller.redirect(external: redirect_url)
|
||||
|> halt()
|
||||
|
||||
_ ->
|
||||
|
@ -54,20 +54,37 @@ defmodule Pleroma.Web.MediaProxy.MediaProxyControllerTest do
|
||||
} = get(conn, "/proxy/hhgfh/eeee/fff")
|
||||
end
|
||||
|
||||
test "it returns a 400 for invalid host", %{conn: conn} do
|
||||
clear_config([:media_proxy, :base_url], "http://mp.localhost/")
|
||||
test "it returns a 302 for invalid host", %{conn: conn} do
|
||||
new_proxy_base = "http://mp.localhost/"
|
||||
|
||||
url =
|
||||
%{scheme: new_proxy_scheme, host: new_proxy_host, port: new_proxy_port} =
|
||||
URI.parse(new_proxy_base)
|
||||
|
||||
clear_config([:media_proxy, :base_url], new_proxy_base)
|
||||
|
||||
proxy_url =
|
||||
MediaProxy.encode_url("https://pleroma.social/logo.jpeg")
|
||||
|> URI.parse()
|
||||
|> Map.put(:host, "wronghost")
|
||||
|> URI.to_string()
|
||||
|
||||
expected_url =
|
||||
URI.parse(proxy_url)
|
||||
|> Map.put(:host, new_proxy_host)
|
||||
|> Map.put(:port, new_proxy_port)
|
||||
|> Map.put(:scheme, new_proxy_scheme)
|
||||
|> URI.to_string()
|
||||
|
||||
with_mock Pleroma.ReverseProxy,
|
||||
call: fn _conn, _url, _opts -> %Conn{status: :success} end do
|
||||
%{status: status} = get(conn, url)
|
||||
%{resp_headers: resp_headers, status: status} = get(conn, proxy_url)
|
||||
|
||||
assert status == 400
|
||||
assert status == 302
|
||||
|
||||
assert Enum.any?(
|
||||
resp_headers,
|
||||
&(&1 == {"location", expected_url})
|
||||
)
|
||||
end
|
||||
end
|
||||
|
||||
|
@ -48,10 +48,27 @@ defmodule Pleroma.Web.Plugs.UploadedMediaPlugTest do
|
||||
|
||||
assert conn.status == 200
|
||||
|
||||
clear_config([Pleroma.Upload, :base_url], "http://media.localhost/")
|
||||
new_media_base = "http://media.localhost:8080"
|
||||
|
||||
%{scheme: new_media_scheme, host: new_media_host, port: new_media_port} =
|
||||
URI.parse(new_media_base)
|
||||
|
||||
clear_config([Pleroma.Upload, :base_url], new_media_base)
|
||||
|
||||
conn = get(build_conn(), attachment_url)
|
||||
|
||||
assert conn.status == 400
|
||||
expected_url =
|
||||
URI.parse(attachment_url)
|
||||
|> Map.put(:host, new_media_host)
|
||||
|> Map.put(:port, new_media_port)
|
||||
|> Map.put(:scheme, new_media_scheme)
|
||||
|> URI.to_string()
|
||||
|
||||
assert conn.status == 302
|
||||
|
||||
assert Enum.any?(
|
||||
conn.resp_headers,
|
||||
&(&1 == {"location", expected_url})
|
||||
)
|
||||
end
|
||||
end
|
||||
|
Loading…
Reference in New Issue
Block a user