diff options
author | Mark Chao <mchao@gitlab.com> | 2019-02-13 11:23:58 +0300 |
---|---|---|
committer | Mark Chao <mchao@gitlab.com> | 2019-02-21 11:43:28 +0300 |
commit | 6fc0e015e7bba4a92e009b71849cae6a13b1bb36 (patch) | |
tree | aae7e8735f30e81aaa221d1bc3b21f6d7becfe55 /app | |
parent | 0d5bd8d733aa3be37daec2cf21cc1ef97caee631 (diff) |
Check snippet attached file to be moved is within designated directory
Previously one could move any temp/ sub folder around.
Align spec with actual usage, as currently we pass temp file path to
FileMover.
Diffstat (limited to 'app')
-rw-r--r-- | app/uploaders/file_mover.rb | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/app/uploaders/file_mover.rb b/app/uploaders/file_mover.rb index a7f8615e9ba..236b7ed2b3d 100644 --- a/app/uploaders/file_mover.rb +++ b/app/uploaders/file_mover.rb @@ -11,6 +11,8 @@ class FileMover end def execute + return unless valid? + move if update_markdown @@ -21,6 +23,12 @@ class FileMover private + def valid? + Pathname.new(temp_file_path).realpath.to_path.start_with?( + (Pathname(temp_file_uploader.root) + temp_file_uploader.base_dir).to_path + ) + end + def move FileUtils.mkdir_p(File.dirname(file_path)) FileUtils.move(temp_file_path, file_path) |