saurabh
/
announcement-test
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix security problem

This commit is contained in:
BOYA,CHIU 2021-07-20 19:54:13 +08:00
parent 3048e73cc9
commit 34b74ff308
2 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
app/controllers/announcements_controller.rb
View File

@ -499,6 +499,10 @@ class AnnouncementsController < ApplicationController
@url = request.path
begin
file = BulletinFile.find(params[:id])
if File.basename(file.file.path) != URI.decode(params[:f_name])
render :file => "#{Rails.root}/app/views/errors/403.html", :layout => false, :status => :not_found, :content_type => 'text/html'
return
end
@url = file.file.url
if file.can_access?(OrbitHelper.current_user)
@path = file.file.path rescue ""

2
config/routes.rb
View File

@ -39,7 +39,7 @@ Rails.application.routes.draw do
get '/xhr/announcements/announcement.json', to: 'bulletins#get_bulletins'
get '/xhr/panel/announcement/widget/sync_data' => 'announcements#show_widget'
get '/xhr/announcements/:slug_title-:uid/comment', to: 'announcements#comment'
get '/xhr/announcements/file/:id/*f_name' => 'announcements#get_file'
get '/xhr/announcements/file/:id/*f_name', to: 'announcements#get_file', format: false
end
end