Merge Revert "Merge branch 'validate-host' into 'develop'"
This reverts commitd998a114e2
, reversing changes made toda6b4003ac
.
This commit is contained in:
parent
4367579949
commit
dd9f8150fc
@ -1 +0,0 @@
|
|||||||
Validate Host header for Uploads and return a 302 if the base_url has changed
|
|
0
changelog.d/3909.skip
Normal file
0
changelog.d/3909.skip
Normal file
@ -46,32 +46,12 @@ defmodule Pleroma.Web.Plugs.UploadedMedia do
|
|||||||
|
|
||||||
config = Pleroma.Config.get(Pleroma.Upload)
|
config = Pleroma.Config.get(Pleroma.Upload)
|
||||||
|
|
||||||
%{scheme: media_scheme, host: media_host, port: media_port} =
|
with uploader <- Keyword.fetch!(config, :uploader),
|
||||||
Pleroma.Upload.base_url() |> URI.parse()
|
|
||||||
|
|
||||||
with {:valid_host, true} <- {:valid_host, match?(^media_host, conn.host)},
|
|
||||||
uploader <- Keyword.fetch!(config, :uploader),
|
|
||||||
proxy_remote = Keyword.get(config, :proxy_remote, false),
|
proxy_remote = Keyword.get(config, :proxy_remote, false),
|
||||||
{:ok, get_method} <- uploader.get_file(file),
|
{:ok, get_method} <- uploader.get_file(file),
|
||||||
false <- media_is_banned(conn, get_method) do
|
false <- media_is_banned(conn, get_method) do
|
||||||
get_media(conn, get_method, proxy_remote, opts)
|
get_media(conn, get_method, proxy_remote, opts)
|
||||||
else
|
else
|
||||||
{:valid_host, false} ->
|
|
||||||
redirect_url =
|
|
||||||
%URI{
|
|
||||||
scheme: media_scheme,
|
|
||||||
host: media_host,
|
|
||||||
port: media_port,
|
|
||||||
path: conn.request_path,
|
|
||||||
query: conn.query_string
|
|
||||||
}
|
|
||||||
|> URI.to_string()
|
|
||||||
|> String.trim_trailing("?")
|
|
||||||
|
|
||||||
conn
|
|
||||||
|> Phoenix.Controller.redirect(external: redirect_url)
|
|
||||||
|> halt()
|
|
||||||
|
|
||||||
_ ->
|
_ ->
|
||||||
conn
|
conn
|
||||||
|> send_resp(:internal_server_error, dgettext("errors", "Failed"))
|
|> send_resp(:internal_server_error, dgettext("errors", "Failed"))
|
||||||
|
@ -40,30 +40,4 @@ defmodule Pleroma.Web.Plugs.UploadedMediaPlugTest do
|
|||||||
&(&1 == {"content-disposition", ~s[inline; filename="\\"cofe\\".gif"]})
|
&(&1 == {"content-disposition", ~s[inline; filename="\\"cofe\\".gif"]})
|
||||||
)
|
)
|
||||||
end
|
end
|
||||||
|
|
||||||
test "denies access to media if wrong Host", %{
|
|
||||||
attachment_url: attachment_url
|
|
||||||
} do
|
|
||||||
conn = get(build_conn(), attachment_url)
|
|
||||||
|
|
||||||
assert conn.status == 200
|
|
||||||
|
|
||||||
new_media_base = "http://media.localhost:8080"
|
|
||||||
|
|
||||||
%{scheme: new_media_scheme, host: new_media_host, port: new_media_port} =
|
|
||||||
URI.parse(new_media_base)
|
|
||||||
|
|
||||||
clear_config([Pleroma.Upload, :base_url], new_media_base)
|
|
||||||
|
|
||||||
conn = get(build_conn(), attachment_url)
|
|
||||||
|
|
||||||
expected_url =
|
|
||||||
URI.parse(attachment_url)
|
|
||||||
|> Map.put(:host, new_media_host)
|
|
||||||
|> Map.put(:port, new_media_port)
|
|
||||||
|> Map.put(:scheme, new_media_scheme)
|
|
||||||
|> URI.to_string()
|
|
||||||
|
|
||||||
assert redirected_to(conn, 302) == expected_url
|
|
||||||
end
|
|
||||||
end
|
end
|
||||||
|
Loading…
Reference in New Issue
Block a user