floraachy
/
gitlink-forgeplus
mirror of https://gitlink.org.cn/Gitlink/forgeplus.git
1
0
Fork 0
Code Issues Actions Packages Projects Releases Wiki Activity

fixed 解决安全问题访问附件，id改为uuid

This commit is contained in:
xxq250 2023-11-22 11:17:22 +08:00
parent 6ae4aded65
commit 2ea41d0100
5 changed files with 25 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
app/controllers/attachments_controller.rb
View File

@ -94,6 +94,7 @@ class AttachmentsController < ApplicationController
@attachment.author_id = current_user.id @attachment.author_id = current_user.id
@attachment.disk_directory = month_folder @attachment.disk_directory = month_folder
@attachment.cloud_url = remote_path @attachment.cloud_url = remote_path
@attachment.uuid = SecureRandom.uuid
@attachment.save! @attachment.save!
else else
logger.info "文件已存在，id = #{@attachment.id}, filename = #{@attachment.filename}" logger.info "文件已存在，id = #{@attachment.id}, filename = #{@attachment.filename}"
@ -147,8 +148,9 @@ class AttachmentsController < ApplicationController
if params[:type] == 'history' if params[:type] == 'history'
AttachmentHistory.find params[:id] AttachmentHistory.find params[:id]
else else
Attachment.find params[:id] || Attachment.find_by(uuid: params[:id]) Attachment.find_by(id: params[:id]) || Attachment.find_by(uuid: params[:id])
end end
tip_exception(404, "您访问的页面不存在或已被删除") if @file.blank?
end end
def delete_file(file_path) def delete_file(file_path)

2
app/helpers/application_helper.rb
View File

@ -299,7 +299,7 @@ module ApplicationHelper
end end
def download_url attachment,options={} def download_url attachment,options={}
attachment_path(attachment,options) attachment&.uuid.present? ? attachment_path(attachment.uuid,options) : attachment_path(attachment,options)
end end
# 耗时：天、小时、分、秒 # 耗时：天、小时、分、秒

10
app/models/issue.rb
View File

@ -248,6 +248,7 @@ class Issue < ApplicationRecord
# 关附件到功能 # 关附件到功能
def associate_attachment_container def associate_attachment_container
return if self.project_id == 0
att_ids = [] att_ids = []
# 附件的格式为（/api/attachments/ + 附件id）的形式，提取出id进行附件属性关联，做附件访问权限控制 # 附件的格式为（/api/attachments/ + 附件id）的形式，提取出id进行附件属性关联，做附件访问权限控制
att_ids += self.description.to_s.scan(/\(\/api\/attachments\/.+\)/).map{|s|s.match(/\d+/)[0]} att_ids += self.description.to_s.scan(/\(\/api\/attachments\/.+\)/).map{|s|s.match(/\d+/)[0]}
@ -256,6 +257,15 @@ class Issue < ApplicationRecord
if att_ids.present? if att_ids.present?
Attachment.where(id: att_ids).where("container_type IS NULL OR container_type = 'Issue'").update_all(container_id: self.project_id, container_type: 'Project') Attachment.where(id: att_ids).where("container_type IS NULL OR container_type = 'Issue'").update_all(container_id: self.project_id, container_type: 'Project')
end end
att_ids2 = []
# uuid_regex= /[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/
# 附件的格式为（/api/attachments/ + uuid）的形式，提取出id进行附件属性关联，做附件访问权限控制
att_ids2 += self.description.to_s.scan(/\(\/api\/attachments\/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\)/).map{|s|s.match(/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/)[0]}
att_ids2 += self.description.to_s.scan(/\/api\/attachments\/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/).map{|s|s.match(/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/)[0]}
if att_ids2.present?
Attachment.where(uuid: att_ids2).where("container_type IS NULL OR container_type = 'Issue'").update_all(container_id: self.project_id, container_type: 'Project')
end
end end
def to_builder def to_builder

10
app/models/journal.rb
View File

@ -61,6 +61,7 @@ class Journal < ApplicationRecord
# 关附件到功能 # 关附件到功能
def associate_attachment_container def associate_attachment_container
return if self.issue&.project_id.to_i == 0
att_ids = [] att_ids = []
# 附件的格式为（/api/attachments/ + 附件id）的形式，提取出id进行附件属性关联，做附件访问权限控制 # 附件的格式为（/api/attachments/ + 附件id）的形式，提取出id进行附件属性关联，做附件访问权限控制
att_ids += self.notes.to_s.scan(/\(\/api\/attachments\/.+\)/).map{|s|s.match(/\d+/)[0]} att_ids += self.notes.to_s.scan(/\(\/api\/attachments\/.+\)/).map{|s|s.match(/\d+/)[0]}
@ -69,6 +70,15 @@ class Journal < ApplicationRecord
if att_ids.present? if att_ids.present?
Attachment.where(id: att_ids).where("container_type IS NULL OR container_type = 'Journal'").update_all(container_id: self.issue.project_id, container_type: "Project") Attachment.where(id: att_ids).where("container_type IS NULL OR container_type = 'Journal'").update_all(container_id: self.issue.project_id, container_type: "Project")
end end
att_ids2 = []
# uuid_regex= /[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/
# 附件的格式为（/api/attachments/ + uuid）的形式，提取出id进行附件属性关联，做附件访问权限控制
att_ids2 += self.description.to_s.scan(/\(\/api\/attachments\/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\)/).map{|s|s.match(/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/)[0]}
att_ids2 += self.description.to_s.scan(/\/api\/attachments\/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/).map{|s|s.match(/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/)[0]}
if att_ids2.present?
Attachment.where(uuid: att_ids).where("container_type IS NULL OR container_type = 'Journal'").update_all(container_id: self.issue.project_id, container_type: "Project")
end
end end
def operate_content def operate_content

2
app/views/attachments/create.json.jbuilder
View File

@ -1,4 +1,4 @@
json.id @attachment.id json.id @attachment.uuid
json.title @attachment.title json.title @attachment.title
json.filesize number_to_human_size(@attachment.filesize) json.filesize number_to_human_size(@attachment.filesize)
json.is_pdf @attachment.is_pdf? json.is_pdf @attachment.is_pdf?