diff --git a/lib/gollum/app.rb b/lib/gollum/app.rb index 55acfebf..645d0b91 100644 --- a/lib/gollum/app.rb +++ b/lib/gollum/app.rb @@ -240,7 +240,7 @@ module Precious halt 500 unless tempfile.is_a? Tempfile if wiki.per_page_uploads - dir = request.referer.sub(request.base_url, '') + dir = request.referer.match(/^https?:\/\/#{request.host_with_port}\/(.*)/)[1] # remove base path if it is set dir.sub!(/^#{wiki.base_path}/, '') if wiki.base_path # remove base_url and gollum/* subpath if necessary diff --git a/test/test_app.rb b/test/test_app.rb index c6da4552..906ec8a8 100644 --- a/test/test_app.rb +++ b/test/test_app.rb @@ -447,6 +447,21 @@ EOF Precious::App.set(:wiki_options, {allow_uploads: false, per_page_uploads: false}) end + test "upload a file with https referer" do + temp_upload_file = Tempfile.new(['https_upload', '.file']) << 'abc' + temp_upload_file.close + Precious::App.set(:wiki_options, {allow_uploads: true, per_page_uploads: true}) + post "/gollum/upload_file", {:file => Rack::Test::UploadedFile.new(::File.open(temp_upload_file))}, {'HTTP_REFERER' => 'https://localhost:4567/Home.md', 'HTTP_HOST' => 'localhost:4567'} + + assert_equal 302, last_response.status # redirect is expected + @wiki.clear_cache + # Find the file in a page-specific subdir (here: Home), based on referer + file = @wiki.file("uploads/Home/#{::File.basename(temp_upload_file.path)}") + assert_equal 'abc', file.raw_data + Precious::App.set(:wiki_options, {allow_uploads: false, per_page_uploads: false}) + end + + test "guard against uploading an existing file" do temp_upload_file = Tempfile.new(['upload', '.file']) << 'abc' temp_upload_file.close