summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--api/file.go11
-rw-r--r--api/file_test.go23
-rw-r--r--api/post.go34
-rw-r--r--api/post_test.go2
-rw-r--r--model/client.go2
-rw-r--r--model/utils.go2
6 files changed, 55 insertions, 19 deletions
diff --git a/api/file.go b/api/file.go
index 1dd179422..82cee9d1e 100644
--- a/api/file.go
+++ b/api/file.go
@@ -297,15 +297,14 @@ func getPublicLink(c *Context, w http.ResponseWriter, r *http.Request) {
}
matches := model.PartialUrlRegex.FindAllStringSubmatch(filename, -1)
- if len(matches) == 0 || len(matches[0]) < 5 {
+ if len(matches) == 0 || len(matches[0]) < 4 {
c.SetInvalidParam("getPublicLink", "filename")
return
}
- getType := matches[0][1]
- channelId := matches[0][2]
- userId := matches[0][3]
- filename = matches[0][4]
+ channelId := matches[0][1]
+ userId := matches[0][2]
+ filename = matches[0][3]
cchan := Srv.Store.Channel().CheckPermissionsTo(c.Session.TeamId, channelId, c.Session.UserId)
@@ -316,7 +315,7 @@ func getPublicLink(c *Context, w http.ResponseWriter, r *http.Request) {
data := model.MapToJson(newProps)
hash := model.HashPassword(fmt.Sprintf("%v:%v", data, utils.Cfg.ServiceSettings.PublicLinkSalt))
- url := fmt.Sprintf("%s/api/v1/files/%s/%s/%s/%s?d=%s&h=%s&t=%s", c.GetSiteURL(), getType, channelId, userId, filename, url.QueryEscape(data), url.QueryEscape(hash), c.Session.TeamId)
+ url := fmt.Sprintf("%s/api/v1/files/get/%s/%s/%s?d=%s&h=%s&t=%s", c.GetSiteURL(), channelId, userId, filename, url.QueryEscape(data), url.QueryEscape(hash), c.Session.TeamId)
if !c.HasPermissionsToChannel(cchan, "getPublicLink") {
return
diff --git a/api/file_test.go b/api/file_test.go
index 3f414d768..a708e9bb1 100644
--- a/api/file_test.go
+++ b/api/file_test.go
@@ -5,6 +5,7 @@ package api
import (
"bytes"
+ l4g "code.google.com/p/log4go"
"fmt"
"github.com/goamz/goamz/aws"
"github.com/goamz/goamz/s3"
@@ -197,8 +198,9 @@ func TestGetFile(t *testing.T) {
// wait a bit for files to ready
time.Sleep(5 * time.Second)
- if _, downErr := Client.GetFile(filenames[0], true); downErr != nil {
- t.Fatal("file get failed")
+ l4g.Debug(filenames)
+ if _, downErr := Client.GetFile(filenames[0], false); downErr != nil {
+ t.Fatal(downErr)
}
team2 := &model.Team{DisplayName: "Name", Name: "z-z-" + model.NewId() + "a", Email: "test@nowhere.com", Type: model.TEAM_OPEN}
@@ -217,35 +219,35 @@ func TestGetFile(t *testing.T) {
Client.LoginByEmail(team2.Name, user2.Email, "pwd")
- if _, downErr := Client.GetFile(filenames[0]+"?d="+url.QueryEscape(data)+"&h="+url.QueryEscape(hash)+"&t="+team.Id, true); downErr != nil {
+ if _, downErr := Client.GetFile(filenames[0]+"?d="+url.QueryEscape(data)+"&h="+url.QueryEscape(hash)+"&t="+team.Id, false); downErr != nil {
t.Fatal(downErr)
}
- if _, downErr := Client.GetFile(filenames[0]+"?d="+url.QueryEscape(data)+"&h="+url.QueryEscape(hash), true); downErr == nil {
+ if _, downErr := Client.GetFile(filenames[0]+"?d="+url.QueryEscape(data)+"&h="+url.QueryEscape(hash), false); downErr == nil {
t.Fatal("Should have errored - missing team id")
}
- if _, downErr := Client.GetFile(filenames[0]+"?d="+url.QueryEscape(data)+"&h="+url.QueryEscape(hash)+"&t=junk", true); downErr == nil {
+ if _, downErr := Client.GetFile(filenames[0]+"?d="+url.QueryEscape(data)+"&h="+url.QueryEscape(hash)+"&t=junk", false); downErr == nil {
t.Fatal("Should have errored - bad team id")
}
- if _, downErr := Client.GetFile(filenames[0]+"?d="+url.QueryEscape(data)+"&h="+url.QueryEscape(hash)+"&t=12345678901234567890123456", true); downErr == nil {
+ if _, downErr := Client.GetFile(filenames[0]+"?d="+url.QueryEscape(data)+"&h="+url.QueryEscape(hash)+"&t=12345678901234567890123456", false); downErr == nil {
t.Fatal("Should have errored - bad team id")
}
- if _, downErr := Client.GetFile(filenames[0]+"?d="+url.QueryEscape(data)+"&t="+team.Id, true); downErr == nil {
+ if _, downErr := Client.GetFile(filenames[0]+"?d="+url.QueryEscape(data)+"&t="+team.Id, false); downErr == nil {
t.Fatal("Should have errored - missing hash")
}
- if _, downErr := Client.GetFile(filenames[0]+"?d="+url.QueryEscape(data)+"&h=junk&t="+team.Id, true); downErr == nil {
+ if _, downErr := Client.GetFile(filenames[0]+"?d="+url.QueryEscape(data)+"&h=junk&t="+team.Id, false); downErr == nil {
t.Fatal("Should have errored - bad hash")
}
- if _, downErr := Client.GetFile(filenames[0]+"?h="+url.QueryEscape(hash)+"&t="+team.Id, true); downErr == nil {
+ if _, downErr := Client.GetFile(filenames[0]+"?h="+url.QueryEscape(hash)+"&t="+team.Id, false); downErr == nil {
t.Fatal("Should have errored - missing data")
}
- if _, downErr := Client.GetFile(filenames[0]+"?d=junk&h="+url.QueryEscape(hash)+"&t="+team.Id, true); downErr == nil {
+ if _, downErr := Client.GetFile(filenames[0]+"?d=junk&h="+url.QueryEscape(hash)+"&t="+team.Id, false); downErr == nil {
t.Fatal("Should have errored - bad data")
}
@@ -429,6 +431,7 @@ func TestGetPublicLink(t *testing.T) {
t.Fatal(err)
}
} else {
+ l4g.Debug(resp.Data.(*model.FileUploadResponse).Filenames[0])
filenames := strings.Split(resp.Data.(*model.FileUploadResponse).Filenames[0], "/")
filename := filenames[len(filenames)-2] + "/" + filenames[len(filenames)-1]
fileId := strings.Split(filename, ".")[0]
diff --git a/api/post.go b/api/post.go
index 2d25f7ab0..70ff13497 100644
--- a/api/post.go
+++ b/api/post.go
@@ -160,6 +160,40 @@ func CreatePost(c *Context, post *model.Post, doUpdateLastViewed bool) (*model.P
post.UserId = c.Session.UserId
+ if len(post.Filenames) > 0 {
+ doRemove := false
+ for i := len(post.Filenames) - 1; i >= 0; i-- {
+ path := post.Filenames[i]
+
+ doRemove = false
+ l4g.Debug(path)
+ if model.UrlRegex.MatchString(path) {
+ continue
+ } else if model.PartialUrlRegex.MatchString(path) {
+ matches := model.PartialUrlRegex.FindAllStringSubmatch(path, -1)
+ if len(matches) == 0 || len(matches[0]) < 4 {
+ doRemove = true
+ }
+
+ channelId := matches[0][1]
+ if channelId != post.ChannelId {
+ doRemove = true
+ }
+
+ userId := matches[0][2]
+ if userId != post.UserId {
+ doRemove = true
+ }
+ } else {
+ doRemove = true
+ }
+ if doRemove {
+ l4g.Error("Bad filename discarded, filename=%v", path)
+ post.Filenames = append(post.Filenames[:i], post.Filenames[i+1:]...)
+ }
+ }
+ }
+
var rpost *model.Post
if result := <-Srv.Store.Post().Save(post); result.Err != nil {
return nil, result.Err
diff --git a/api/post_test.go b/api/post_test.go
index 0cccc74d3..19a88f737 100644
--- a/api/post_test.go
+++ b/api/post_test.go
@@ -37,7 +37,7 @@ func TestCreatePost(t *testing.T) {
channel2 := &model.Channel{DisplayName: "Test API Name", Name: "a" + model.NewId() + "a", Type: model.CHANNEL_OPEN, TeamId: team.Id}
channel2 = Client.Must(Client.CreateChannel(channel2)).Data.(*model.Channel)
- filenames := []string{"/api/v1/files/get/12345678901234567890123456/12345678901234567890123456/test.png", "/api/v1/files/get/" + channel1.Id + "/" + user1.Id + "/test.png"}
+ filenames := []string{"/12345678901234567890123456/12345678901234567890123456/12345678901234567890123456/test.png", "/" + channel1.Id + "/" + user1.Id + "/test.png", "www.mattermost.com/fake/url", "junk"}
post1 := &model.Post{ChannelId: channel1.Id, Message: "#hashtag a" + model.NewId() + "a", Filenames: filenames}
rpost1, err := Client.CreatePost(post1)
diff --git a/model/client.go b/model/client.go
index c7e17a6db..9a144095a 100644
--- a/model/client.go
+++ b/model/client.go
@@ -550,7 +550,7 @@ func (c *Client) GetFile(url string, isFullUrl bool) (*Result, *AppError) {
if isFullUrl {
rq, _ = http.NewRequest("GET", url, nil)
} else {
- rq, _ = http.NewRequest("GET", c.Url+url, nil)
+ rq, _ = http.NewRequest("GET", c.Url+"/files/get"+url, nil)
}
if len(c.AuthToken) > 0 {
diff --git a/model/utils.go b/model/utils.go
index 38592b984..093a54e38 100644
--- a/model/utils.go
+++ b/model/utils.go
@@ -319,6 +319,6 @@ func ClearMentionTags(post string) string {
}
var UrlRegex = regexp.MustCompile(`^((?:[a-z]+:\/\/)?(?:(?:[a-z0-9\-]+\.)+(?:[a-z]{2}|aero|arpa|biz|com|coop|edu|gov|info|int|jobs|mil|museum|name|nato|net|org|pro|travel|local|internal))(:[0-9]{1,5})?(?:\/[a-z0-9_\-\.~]+)*(\/([a-z0-9_\-\.]*)(?:\?[a-z0-9+_~\-\.%=&amp;]*)?)?(?:#[a-zA-Z0-9!$&'()*+.=-_~:@/?]*)?)(?:\s+|$)$`)
-var PartialUrlRegex = regexp.MustCompile(`/api/v1/files/(get|get_image)/([A-Za-z0-9]{26})/([A-Za-z0-9]{26})/(([A-Za-z0-9]+/)?.+\.[A-Za-z0-9]{3,})`)
+var PartialUrlRegex = regexp.MustCompile(`/([A-Za-z0-9]{26})/([A-Za-z0-9]{26})/((?:[A-Za-z0-9]{26})?.+\.[A-Za-z0-9]{3,})`)
var SplitRunes = map[rune]bool{',': true, ' ': true, '.': true, '!': true, '?': true, ':': true, ';': true, '\n': true, '<': true, '>': true, '(': true, ')': true, '{': true, '}': true, '[': true, ']': true, '+': true, '/': true, '\\': true}
generated by cgit v1.2.3-1-g7c22 (git 2.25.1) at 2024-06-30 19:49:38 +0000