luna/mastodon
0
0
Fork 0
mirror of https://github.com/lunaisnotaboy/mastodon.git synced 2024-11-29 18:14:09 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #242 from TazeTSchnitzel/media_uri_obfuscation

Browse source 
Rename media to avoid exposing filename (fixes #207)
This commit is contained in:
Eugen 2016-11-24 16:27:32 +01:00 committed by GitHub
parent cbc50016eb cefef2c571
commit 7baca3fe4d
3 changed files with 23 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
app/controllers/api/v1/media_controller.rb
View file

@ -4,6 +4,9 @@ class Api::V1::MediaController < ApiController
before_action -> { doorkeeper_authorize! :write } before_action -> { doorkeeper_authorize! :write }
before_action :require_user! before_action :require_user!
include ObfuscateFilename
obfuscate_filename :file
respond_to :json respond_to :json
def create def create

4
app/controllers/settings/profiles_controller.rb
View file

@ -6,6 +6,10 @@ class Settings::ProfilesController < ApplicationController
before_action :authenticate_user! before_action :authenticate_user!
before_action :set_account before_action :set_account
include ObfuscateFilename
obfuscate_filename [:account, :avatar]
obfuscate_filename [:account, :header]
def show def show
end end

16
app/models/concerns/obfuscate_filename.rb Normal file
View file

@ -0,0 +1,16 @@
module ObfuscateFilename
extend ActiveSupport::Concern
class_methods do
def obfuscate_filename(*args)
before_action { obfuscate_filename(*args) }
end
end
def obfuscate_filename(path)
file = params.dig(*path)
return if file.nil?
file.original_filename = "media" + File.extname(file.original_filename)
end
end