Take account of possible https referer in upload route (#1787)

This commit is contained in:
Dawa Ometto
2021-12-23 12:18:30 +01:00
committed by GitHub
parent 7e379cfab1
commit 46c22a8b87
2 changed files with 16 additions and 1 deletions
+1 -1
View File
@@ -240,7 +240,7 @@ module Precious
halt 500 unless tempfile.is_a? Tempfile
if wiki.per_page_uploads
dir = request.referer.sub(request.base_url, '')
dir = request.referer.match(/^https?:\/\/#{request.host_with_port}\/(.*)/)[1]
# remove base path if it is set
dir.sub!(/^#{wiki.base_path}/, '') if wiki.base_path
# remove base_url and gollum/* subpath if necessary
+15
View File
@@ -447,6 +447,21 @@ EOF
Precious::App.set(:wiki_options, {allow_uploads: false, per_page_uploads: false})
end
test "upload a file with https referer" do
temp_upload_file = Tempfile.new(['https_upload', '.file']) << 'abc'
temp_upload_file.close
Precious::App.set(:wiki_options, {allow_uploads: true, per_page_uploads: true})
post "/gollum/upload_file", {:file => Rack::Test::UploadedFile.new(::File.open(temp_upload_file))}, {'HTTP_REFERER' => 'https://localhost:4567/Home.md', 'HTTP_HOST' => 'localhost:4567'}
assert_equal 302, last_response.status # redirect is expected
@wiki.clear_cache
# Find the file in a page-specific subdir (here: Home), based on referer
file = @wiki.file("uploads/Home/#{::File.basename(temp_upload_file.path)}")
assert_equal 'abc', file.raw_data
Precious::App.set(:wiki_options, {allow_uploads: false, per_page_uploads: false})
end
test "guard against uploading an existing file" do
temp_upload_file = Tempfile.new(['upload', '.file']) << 'abc'
temp_upload_file.close